# How organizations work

> The parts of an organization, who can reach each one, how money moves and which credential each API takes.

Source: https://docs.coritan.com/organizations/how-organizations-work/

An organization lets you sell Coritan products as your own. You decide what to sell and at what price, your customers sign in on your storefront, and your team looks after them. Coritan runs the resources, takes the payments as merchant of record and pays you out.

## The parts of an organization

Owner
: The Coritan account that created the organization. The owner has every permission, is the only person who can delete the organization, and cannot be removed or demoted. The resources behind linked products run on the owner's Coritan account.

Members
: Other Coritan accounts you add, each with a role. Members work in the organization's tabs in the Coritan dashboard and in the [staff console](/organizations/staff-console/). [Organization roles and permissions](/organizations/roles-and-permissions/) lists what each role can do.

Customers
: The people who buy from you. A customer account belongs to your organization only: it is not a Coritan account, and a customer never sees coritan.com. Customers sign in on your storefront with an email or a username and a password.

Products and pricing
: What your customers can buy. A *linked* product is backed by a Coritan product, such as a Container Apps plan, and ordering it creates the real resource. A *standalone* product is something you deliver yourself, and nothing is created on Coritan. Each product has one price per billing cycle. See [Set up products and pricing](/organizations/products-and-pricing/).

Customer services
: What a customer holds after an order: one product at one price, renewed each billing cycle until it is cancelled. See [Manage customer services](/organizations/customer-services/).

Storefront
: The site where customers browse, order, pay and manage what they bought. You build it on the [storefront APIs](/organizations/storefront/), and set its logo, colours and legal links in [Settings](/organizations/settings/).

## How money moves

Your organization's *billing mode* decides who takes your customers' payments.

| Billing mode | Who takes payment | Invoices and payouts |
| --- | --- | --- |
| `platform_mor` (Platform merchant of record) | Coritan's payment gateways, with Coritan as merchant of record. | Coritan invoices your customers when their services come due and pays you each month. |
| `own_gateway` (Own gateway) | Your own [PayNow store](/organizations/billing/paynow/). Checkout fails until it is connected. | Coritan raises no renewal invoices and makes no payouts. The money reaches you through PayNow. |
| `hybrid` (Hybrid) | Your PayNow store when it is connected, otherwise Coritan's gateways. | Coritan invoices and pays you out for the money its gateways took. |

A payout is what Coritan's gateways collected for you, less refunds and chargebacks, less the *platform fee*: a percentage Coritan sets for each organization and shows in the organization's header. Invoices you mark paid, invoices paid from customer credit and money your own PayNow store took are not part of a payout. [Track your payouts](/organizations/billing/payouts/) explains the monthly cycle.

Separately, a linked product's resource runs on the owner's Coritan account, which is billed Coritan's price for it like any other Coritan service. Your margin is the difference between your price and Coritan's. See [billing](/billing/) for how a Coritan account pays.

## Credentials for each API

Every Organization API path starts with `https://api.coritan.com/api/v1/orgs/{org_slug}`, where `{org_slug}` is your organization's slug. Which credential a call takes depends on who is calling.

| Caller | Paths | Credential |
| --- | --- | --- |
| A member, from your own tools | The organization itself, members, customers, products, services, billing, DNS, mail, webhooks | `Authorization: Bearer` with the member's Coritan access token, or a staff console session |
| Staff, in the staff console | `/staff/...` and `/chat/...` | `Authorization: Bearer` with a staff session from [staff sign-in](/organizations/staff-console/sign-in/) |
| A signed-in customer | `/portal/...` and the customer's own `/auth/...` calls | `Authorization: Bearer` with a customer token from [customer sign-in](/organizations/storefront/customer-sign-in/) |
| Anyone | `/storefront/...` | None |
| Your servers | `/commerce/...` | `X-API-Key` with an [organization API key](/organizations/api-keys/) and the scopes it needs, or a member's token |
| Your checkout page | `/store/...` | `x-publishable-api-key` with a publishable key, plus the shopper's token for their own orders |

An organization API key works on the Commerce API only. Every other member call needs a person's token, so an automation that manages customers or products signs in as a member.

## Limits

Coritan sets each organization's tier, platform fee and limits on customers, customer services and products. The dashboard shows the tier in the list of organizations. When a limit is reached, the API refuses the next customer, service or product with `403` and names the count, for example `Service limit reached (500/500)`.

## Related

- [Create an organization](/organizations/create-an-organization/)
- [Organization billing](/organizations/billing/)
- [API authentication](/api/)