# Gplay User Management

> User and grant management for Google Play Console via gplay users and gplay grants commands.

User and grant management for Google Play Console via gplay users and gplay grants commands. Use when asked to manage developer account users, account-wide permissions, or per-app access grants.

- Page: https://ss33.ai/skills/tamtom/gplay-user-management-6905161264
- Publisher: tamtom
- Category: [Software Development](https://ss33.ai/skills/category/software-development-t44z8z) › [Mobile apps](https://ss33.ai/skills/category/software-development-t44z8z/mobile-apps-p8puwc)
- License: MIT
- Source: https://github.com/tamtom/gplay-cli-skills/blob/10301b24639e4f768d009b2edda9315cb2149712/skills/gplay-user-management/SKILL.md

## Skill

SKILL.md: https://ss33.ai/api/v1/ss33/download/tamtom/gplay-user-management-6905161264

# User & Grant Management

Manage team members and their permissions in Google Play Console. Two layers:

- **Users** (`gplay users`) — account-wide members. Permissions here (`*_GLOBAL`, `CAN_SEE_ALL_APPS`) apply across the whole developer account.
- **Grants** (`gplay grants`) — per-app access for a user. Permissions here apply to a single package only.

Use **users** to add someone to the account (optionally with account-wide powers). Use **grants** to give an existing user access to specific apps without granting account-wide reach. Least privilege: prefer per-app grants over global permissions.

## Preconditions

- Credentials set (`gplay auth login` or `GPLAY_SERVICE_ACCOUNT`).
- Service account needs permission to manage users (`CAN_MANAGE_PERMISSIONS_GLOBAL`).
- **Developer ID** is required for every command. Pass it with `--developer`. Find it in the Play Console URL (`play.google.com/console/u/0/developers/<DEVELOPER_ID>/...`).

## Key concepts

- The flag is `--developer` (Developer ID), **not** `--developer-id`.
- There is **no** `--role` or `--permissions` flag. Permissions are supplied as a JSON body via `--json`.
- `--json` accepts an inline JSON string **or** `@path/to/file.json`.
- Users JSON key: `developerAccountPermissions` (account-wide). Grants JSON key: `appLevelPermissions` (per-app).
- `delete` requires `--confirm` — it is a no-op safety guard, and the deletion is irreversible.

## Users (account-wide)

```bash
# List users
gplay users list --developer DEVELOPER_ID
gplay users list --developer DEVELOPER_ID --paginate --page-size 50
gplay users list --developer DEVELOPER_ID --output table

# Create a user (inline JSON)
gplay users create \
  --developer DEVELOPER_ID \
  --email user@example.com \
  --json '{"developerAccountPermissions":["CAN_SEE_ALL_APPS"]}'

# Create with an expiration and JSON from a file
gplay users create \
  --developer DEVELOPER_ID \
  --email contractor@example.com \
  --json @perms.json

# Update a user's account-wide permissions
gplay users update \
  --developer DEVELOPER_ID \
  --email user@example.com \
  --json '{"developerAccountPermissions":["CAN_SEE_ALL_APPS","CAN_VIEW_FINANCIAL_DATA_GLOBAL"]}'

# Delete a user (requires --confirm)
gplay users delete \
  --developer DEVELOPER_ID \
  --email user@example.com \
  --confirm
```

Users JSON body (`expirationTime` is optional, RFC 3339):

```json
{
  "developerAccountPermissions": [
    "CAN_SEE_ALL_APPS",
    "CAN_VIEW_FINANCIAL_DATA_GLOBAL"
  ],
  "expirationTime": "2025-12-31T23:59:59Z"
}
```

`update` also accepts `--update-mask` (comma-separated fields) to update only specific fields; if omitted, all fields in the body are applied.

### Account-level permissions (users)

`CAN_SEE_ALL_APPS`, `CAN_VIEW_FINANCIAL_DATA_GLOBAL`, `CAN_MANAGE_PERMISSIONS_GLOBAL`,
`CAN_EDIT_GAMES_GLOBAL`, `CAN_PUBLISH_GAMES_GLOBAL`, `CAN_REPLY_TO_REVIEWS_GLOBAL`,
`CAN_MANAGE_PUBLIC_APKS_GLOBAL`, `CAN_MANAGE_TRACK_APKS_GLOBAL`, `CAN_MANAGE_TRACK_USERS_GLOBAL`,
`CAN_MANAGE_PUBLIC_LISTING_GLOBAL`, `CAN_MANAGE_DRAFT_APPS_GLOBAL`,
`CAN_CREATE_MANAGED_PLAY_APPS_GLOBAL`, `CAN_CHANGE_MANAGED_PLAY_SETTING_GLOBAL`,
`CAN_MANAGE_ORDERS_GLOBAL`

## Grants (per-app)

```bash
# Grant a user access to one app
gplay grants create \
  --developer DEVELOPER_ID \
  --email user@example.com \
  --package com.example.app \
  --json '{"appLevelPermissions":["CAN_ACCESS_APP","CAN_MANAGE_PUBLIC_APKS"]}'

# Update an app grant
gplay grants update \
  --developer DEVELOPER_ID \
  --email user@example.com \
  --package com.example.app \
  --json '{"appLevelPermissions":["CAN_ACCESS_APP","CAN_MANAGE_PUBLIC_LISTING"]}'

# Revoke an app grant (requires --confirm)
gplay grants delete \
  --developer DEVELOPER_ID \
  --email user@example.com \
  --package com.example.app \
  --confirm
```

Grants JSON body:

```json
{
  "appLevelPermissions": [
    "CAN_ACCESS_APP",
    "CAN_MANAGE_PUBLIC_APKS"
  ]
}
```

`update` also accepts `--update-mask`.

### App-level permissions (grants)

`CAN_ACCESS_APP` (basic access), `CAN_VIEW_FINANCIAL_DATA`, `CAN_MANAGE_PERMISSIONS`,
`CAN_REPLY_TO_REVIEWS`, `CAN_MANAGE_PUBLIC_APKS` (production releases),
`CAN_MANAGE_TRACK_APKS` (test tracks), `CAN_MANAGE_TRACK_USERS` (testers),
`CAN_MANAGE_PUBLIC_LISTING`, `CAN_MANAGE_DRAFT_APPS`, `CAN_MANAGE_ORDERS`

## Permission recipes

Build the JSON body from the constants above. `CAN_ACCESS_APP` is the base for any app grant.

**Read-only viewer (per app):**
```json
{"appLevelPermissions":["CAN_ACCESS_APP"]}
```

**Release manager (per app):**
```json
{"appLevelPermissions":["CAN_ACCESS_APP","CAN_MANAGE_PUBLIC_APKS","CAN_MANAGE_TRACK_APKS","CAN_MANAGE_TRACK_USERS","CAN_MANAGE_DRAFT_APPS"]}
```

**Finance (per app):**
```json
{"appLevelPermissions":["CAN_ACCESS_APP","CAN_VIEW_FINANCIAL_DATA","CAN_MANAGE_ORDERS"]}
```

**Account-wide finance (user):**
```json
{"developerAccountPermissions":["CAN_SEE_ALL_APPS","CAN_VIEW_FINANCIAL_DATA_GLOBAL"]}
```

## Workflows

**Onboard a member scoped to specific apps** — create the user with minimal (or no) account-wide permissions, then add per-app grants:
```bash
gplay users create --developer DEVELOPER_ID --email dev@example.com \
  --json '{"developerAccountPermissions":[]}'
gplay grants create --developer DEVELOPER_ID --email dev@example.com \
  --package com.example.app --json '{"appLevelPermissions":["CAN_ACCESS_APP","CAN_MANAGE_PUBLIC_APKS"]}'
```

**Offboard** — delete the user to revoke all access at once:
```bash
gplay users delete --developer DEVELOPER_ID --email departed@example.com --confirm
```

**Audit** — list everyone as a table:
```bash
gplay users list --developer DEVELOPER_ID --paginate --output table
```