# Link your account to a Coritan staff account

> If you work at Coritan, link your own account to your staff account with a one-time link from the admin console, or remove the link.

Source: https://www.coritan.com/docs/account/staff-link/

This page is for people who work at Coritan. Your staff account signs in to the admin console, and your own Coritan account signs in to coritan.com. Linking the two lets mailboxes that are shared with you as staff open in the webmail of your own account.

## Before you begin

- A staff account that can sign in to the admin console.
- Your own Coritan account, with [two-factor authentication](/docs/account/two-factor-authentication/) on. Staff mail opens in this account, so it needs the second factor.

## Link the accounts

1. In the admin console, open your own account page and make a one-time link for your Coritan account. The link works once, for ten minutes. Making a new one cancels the old one.
2. Open the link in a browser where you are signed in to your own Coritan account. It opens the **Security** tab of **Settings**, with a **Coritan staff** card.
3. Select **Link to my staff account**.

## Result

A message confirms `Linked. Mailboxes shared with you as staff now open in your webmail.` The **Coritan staff** card names the staff account you linked, and those mailboxes appear among the mailboxes your [webmail](/docs/mail/webmail/mailboxes-and-sharing/) can open. If the staff account is later deactivated, the card says so, and staff mailboxes stop opening in your account.

## Remove the link

1. In the sidebar, select **Settings**, then the **Security** tab.
2. In the **Coritan staff** card, select **Unlink**.

Staff mailboxes stop opening in your account. You can also remove the link from the admin console, and so can a colleague who manages staff accounts.

## Troubleshooting

`Turn on two-factor authentication first: staff mail opens in this account.`
: **Link to my staff account** stays greyed out until [two-factor authentication](/docs/account/two-factor-authentication/) is on. Turn it on, then open the link again.

`That link has expired or was already used. Make a new one in the admin console.`
: The link is more than ten minutes old, was used already, or a newer link replaced it. Make a new one.

`That staff account is no longer active.`
: The staff account was deactivated. Ask a colleague who manages staff accounts.

`This account is already linked to another staff account.`
: Remove the other link first, from this card or from the admin console.

`Too many requests for this action. Please wait and try again.`
: You tried more than ten links in an hour. Wait before the next try.

## Related

- [Turn on two-factor authentication](/docs/account/two-factor-authentication/)
- [Open and share mailboxes in webmail](/docs/mail/webmail/mailboxes-and-sharing/)

## With the API

These endpoints take your access token. [`GET /auth/me/staff-link`](/docs/api/reference/client/authentication/#op-get-api-v1-auth-me-staff-link) answers with the linked staff account, or `{"linked": null}`:

```json
{"linked": {"name": "Alex", "email": "alex@example.com", "active": true}}
```

[`POST /auth/me/staff-link`](/docs/api/reference/client/authentication/#op-post-api-v1-auth-me-staff-link) links the accounts. Send the `staff_link` value from the link as `code`:

```bash
curl -X POST https://api.coritan.com/api/v1/auth/me/staff-link \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"code": "code from the link"}'
```

It answers with the same shape as `GET`. A refusal answers `422` with `{"detail": {"code": "...", "message": "..."}}`, where `code` is `invalid_code`, `inactive`, `mfa_required` or `already_linked` and `message` is the sentence shown above. More than ten tries in an hour answers `429`.

[`DELETE /auth/me/staff-link`](/docs/api/reference/client/authentication/#op-delete-api-v1-auth-me-staff-link) removes the link and answers `{"linked": null}`.

## API

- `GET /api/v1/auth/me/staff-link`: Get staff link (https://www.coritan.com/docs/api/reference/client/authentication/#op-get-api-v1-auth-me-staff-link)
- `POST /api/v1/auth/me/staff-link`: Redeem staff link (https://www.coritan.com/docs/api/reference/client/authentication/#op-post-api-v1-auth-me-staff-link)
- `DELETE /api/v1/auth/me/staff-link`: Remove staff link (https://www.coritan.com/docs/api/reference/client/authentication/#op-delete-api-v1-auth-me-staff-link)