Overview
Hub for MSPs is the unified workspace at app.theonestack.com where MSP owners, admins, technicians, and staff run every product The One Stack offers from a single browser tab. A single sign-in gives you access to PSA, CRM, RMM, Security, Voice, Projects, THEO AI, and 30+ other modules, plus the tools to manage your team, your clients, and your billing. The Hub is where you spend your day.
Key Features
- BAA (Business Associate Agreement) — download, review, and e-sign.
- DPA (Data Processing Agreement) — same flow.
- Subprocessor list — who The One Stack shares data with.
- Security questionnaire — a pre-filled CAIQ-style response you can share with prospects.
- DR test results — most recent disaster recovery test outcomes.
- Incident history — public security incidents, if any.
How To: Request data export or deletion (GDPR)
- Go to Settings → Data & Privacy (
/settings/data). - Click Request erasure (or export).
- A request is filed and tracked. Platform owners can review and process it.
How To: Sign out of all sessions
To sign out of the current browser: avatar → Sign out.
To sign out of all devices (phone, other browsers), change your password or ask an admin to suspend then reactivate your account.
Frequently Asked Questions
Why did I get signed out mid-session?
Hub sessions last 8 hours. You'll see a "Stay signed in?" toast 5 minutes before expiry — click it to extend. If you dismiss it or walk away, you're signed out. Changing your password or being suspended by an admin also ends every session instantly.
I get "MFA required" but I never set it up. What now?
Your organization owner has made MFA mandatory. On your next sign-in you'll be walked through TOTP setup. Use Google Authenticator, Microsoft Authenticator, 1Password, or any standard TOTP app.
The "Continue with Microsoft" button doesn't appear.
Microsoft SSO must be enabled by The One Stack for your region. If it's missing, sign in with email + password instead. For self-hosted M365 tenant connection, contact support.
I can see a product tile but clicking it takes me to the billing page.
Your org no longer has an active entitlement (trial expired, subscription canceled, payment failed). Activate or re-subscribe from /billing/plans.
I'm an Admin but I can't change billing.
Billing actions (change payment method, cancel subscription, apply bundle) require the Owner or Finance role. Ask your Owner to promote you or make the change.
How do I know if my session is an impersonation?
If a platform admin is impersonating you for support, you'll see an orange banner at the top of every page: "Impersonating {your name}." Impersonation sessions last 30 minutes maximum and every action is logged.
Can I use the Hub on mobile?
Yes — the responsive SPA works on phones. For richer mobile workflows (push notifications, PSA time entry, RMM device lookup), install the native iOS/Android app.
What happens to my sessions if I change my password?
Every existing session on every device is revoked immediately. You'll need to sign in again everywhere.
I'm a dogfood/internal org (The One Stack team). Why do I see every product?
The is_platform_owner flag is set on your org. Every user in an internal org sees the full product catalog with no billing enforcement. Unlike normal orgs, you cannot be charged.
Where do I manage API keys for scripts or integrations?
API keys are managed in The One Bridge (bridge.theonestack.com). The Hub Settings → API Keys page is just a handoff to Bridge.
Why did my custom portal domain stop working?
DNS verification may have lapsed or the Cloudflare Worker route is misconfigured. Go to /brand, remove and re-add the domain, and follow the DNS steps again.
How do I buy more seats or endpoints for a product?
Go to /billing/plans and change the plan tier. For per-seat products, activation of a new user automatically increments the seat count on the next invoice.
My teammate's invite expired. Can I resend it?
Yes — go to Settings → Users, find their row (status: Invited), click the "..." menu, and choose Resend invite. A new 7-day link is emailed.
Troubleshooting
"Your account has been disabled." An Owner or Admin suspended or deactivated your account. Contact them to have it reactivated. Platform admins can also suspend accounts for abuse.
"MFA verification failed." Your phone clock may be out of sync — TOTP codes are time-based. Enable automatic time on your device. If you've lost your phone entirely, use one of your recovery codes instead, or ask your Owner/Admin to reset MFA via Settings → Users → (your account) → Reset MFA.
"Session expired" after clicking a link in an email. Invite links are good for 7 days; password reset links for 1 hour; magic links for 15 minutes. If yours expired, request a fresh one from the Forgot Password / invite-resend flow.
Sign-in loop between Hub and Microsoft.
Your browser may be blocking third-party cookies. Enable cookies for login.microsoftonline.com and app.theonestack.com. Alternatively, use an Incognito / Private window to isolate the issue.
"You are not entitled to this product."
Your org doesn't have an active subscription for this product. Go to /products, start a trial or activate, then retry.
Blank page or "Something went wrong" after login. Hard refresh with Cmd/Ctrl-Shift-R, or open DevTools → Application → Clear Site Data. If that doesn't help, try an Incognito window. If the issue persists, contact support with the page URL and any error text.
Payment failed, I got a past-due notice.
Check Settings → Billing → Payment methods. Update your card, then go to Invoices and click Pay now on the overdue invoice. The Hub auto-retries payment at staged intervals (day 1, 3, 7, 14). On day 14 without payment, access is suspended. On day 30, the subscription is canceled. Internal (is_platform_owner) orgs are never billed and skip this entirely.
Invoice PDF won't download. The invoice may still be generating. Wait 5–10 minutes. If it still fails, use Manage billing on the Billing page to open the Stripe billing portal, where every invoice PDF is always available.
"Preview mode" banner is stuck showing. A platform admin handed you a preview-mode token (read-only view of another org). Close the tab or click Exit preview in the banner. Preview tokens expire after the session ends.
The agent installer says the token is invalid or expired. The token may have been revoked, used up its Max uses, or passed its Expires date (by default 25 installs or 30 days). Generate a new token on Endpoints → Install and run the install command again. Devices that are already enrolled don't need a new token.
Nothing happens when I click a product tile. The product module is still loading the first time (lazy-loaded to keep initial sign-in fast). Wait a second. If it stays stuck, refresh the page. Persistent failure means a deployment issue — contact support.
"SSO misconfigured" or "Platform not recognized." You tried to launch a product whose SSO URL hasn't been set up. This should only happen for brand-new products. Report it to support.