> ## Documentation Index
> Fetch the complete documentation index at: https://docs.timetracker.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Invoice permissions

> Who can create, send and void invoices in TimeTracker, who can record payments, and how the app switch and the Pro plan gate interact with capabilities.

Invoicing uses two capabilities. `invoice.manage` covers the document. `payment.record` covers the money against it.

| Capability       | What it allows                                                          | Default roles                          |
| ---------------- | ----------------------------------------------------------------------- | -------------------------------------- |
| `invoice.manage` | Create, edit, send, void, list, open and export invoices                | Owner, Admin, Project Manager, Finance |
| `payment.record` | Record payments, issue credit notes, write off balances, send reminders | Owner, Admin, Project Manager, Finance |

## What each capability unlocks

<Tabs>
  <Tab title="invoice.manage">
    * See **Invoices** in the sidebar
    * Open the invoice list and any invoice
    * Create an invoice
    * Edit a draft
    * Send an invoice
    * Void an invoice
    * Export the PDF
    * See the next automatic invoice number
    * See which time and expenses are available to invoice
  </Tab>

  <Tab title="payment.record">
    * **Record payment**
    * **Issue credit note**
    * **Write off remaining balance**
    * **Send reminder**
    * See an invoice's payment ledger
  </Tab>
</Tabs>

## Roles at a glance

| Role            | `invoice.manage` | `payment.record` |
| --------------- | ---------------- | ---------------- |
| Owner           | Yes              | Yes              |
| Admin           | Yes              | Yes              |
| Project Manager | Yes              | Yes              |
| Finance         | Yes              | Yes              |
| Member          | No               | No               |
| Contractor      | No               | No               |
| Client          | No               | No               |

Four roles can invoice. Three cannot see the Invoices page at all.

## Finance and Project Manager both invoice

They come at it from different directions.

* **Daniel Okafor (Finance)** owns the money surface. He raises invoices, records payments and chases what is owed. He holds no rate capability, and no delivery capability – he cannot approve a timesheet.
* **Priya Raman (Project Manager)** owns delivery. She approves the time, manages budgets, and can invoice the work she runs.

Neither is above the other. See [/concepts/roles-and-capabilities](/concepts/roles-and-capabilities).

## Three gates, in order

A write into invoicing has to pass three separate checks.

<Steps>
  <Step title="Is the app on?">
    The **Invoices** app can be switched off per workspace at **Settings** → **Apps**. Off means hidden – the sidebar item is gone, and a direct URL does not work either.
  </Step>

  <Step title="Does the plan include it?">
    Invoicing and payments are Pro features. Not on your plan means visible with an upgrade prompt, not hidden.
  </Step>

  <Step title="Do you hold the capability?">
    Without `invoice.manage`, the page refuses to load its data.
  </Step>
</Steps>

<Note>
  "Switched off" and "not on your plan" are different things. Off means gone. Not on your plan means it stays in the sidebar and shows an upgrade prompt, so you can always see what you are missing. See [/concepts/apps-and-modules](/concepts/apps-and-modules).
</Note>

## The plan gates in detail

| Action                                     | Feature     | Plan         |
| ------------------------------------------ | ----------- | ------------ |
| Create or edit an invoice                  | `invoicing` | Pro          |
| Send an invoice                            | `invoicing` | Pro          |
| Record a payment, credit note or write-off | `payments`  | Pro          |
| Download the invoice PDF                   | `exports`   | Pro          |
| Read the invoice list and any invoice      | –           | Free and Pro |
| Void an invoice                            | –           | Free and Pro |

Dropping to Free never hides your invoices. The list and every document stay readable, so your records are always yours. See [/concepts/plans-and-features](/concepts/plans-and-features).

## Cost never reaches an invoice

Invoices carry client-facing money only – subtotal, discount, tax, total, and the ledger. Internal cost is removed before any invoice data leaves the server, whoever is asking.

That is why an invoice can safely be shown in the client portal, and why the PDF is safe to forward.

Cost visibility is its own capability, `rate.viewCost`, and it applies to rates and time entries, not to invoices. See [/rates/rate-permissions](/rates/rate-permissions).

## Client portal contacts

A portal contact holds **zero** internal capabilities. They see:

* Invoices belonging to their own client company
* The invoice lines, redacted for a client audience
* Nothing about your other clients, your team's rates, or your costs

See [/portal/overview](/portal/overview).

## Buttons appear only when you can use them

The invoice screen hides actions you cannot take, so you never click into a refusal:

| Action                          | Shown when                                                                              |
| ------------------------------- | --------------------------------------------------------------------------------------- |
| **Edit**                        | The invoice is a draft **and** you hold `invoice.manage`                                |
| **Send invoice**                | The invoice is a draft **and** you hold `invoice.manage`                                |
| **Record payment**              | The invoice is issued and not final **and** you hold `payment.record`                   |
| **Issue credit note**           | The same                                                                                |
| **Write off remaining balance** | The same                                                                                |
| **Send reminder**               | The status is sent, viewed, partially paid or overdue **and** you hold `payment.record` |
| **Void invoice**                | The invoice is not void **and** you hold `invoice.manage`                               |
| **PDF export**                  | Always shown on an invoice you can open                                                 |

Every one of them is re-checked on the server, so a hidden button is a convenience, not the security.

## Capability is not scope

A capability says **whether** you may act. Which clients and projects you can act on is your supervision scope. Both have to pass, so a Project Manager with `invoice.manage` can still only invoice the clients and projects in their scope.

## Common questions

<AccordionGroup>
  <Accordion title="Can someone invoice but not take payment?">
    Yes, through a custom role with `invoice.manage` but not `payment.record`. The default roles always hold both together.
  </Accordion>

  <Accordion title="Can a Member see invoices for their own project?">
    No. Members hold neither capability, so the Invoices page is not available to them.
  </Accordion>

  <Accordion title="Why can Finance invoice without seeing rates?">
    Because pricing already happened. Every time entry carries the rate it was recorded at, so the builder shows money without ever showing a rate table.
  </Accordion>

  <Accordion title="Can a client see an invoice?">
    Only through the client portal, only for their own company, and only redacted for a client audience.
  </Accordion>

  <Accordion title="What if the Invoices app is switched off?">
    The sidebar item disappears, direct URLs stop working, and nothing can be written. No data is deleted – turning the app back on brings everything back.
  </Accordion>

  <Accordion title="Can I stop one person invoicing without changing their role?">
    Some capabilities can be denied per person. Check the person's record, or move them to a custom role.
  </Accordion>
</AccordionGroup>

## Troubleshooting

| Symptom                                            | Cause                                                        | Fix                                           |
| -------------------------------------------------- | ------------------------------------------------------------ | --------------------------------------------- |
| **Invoices** is missing from the sidebar           | The app is off, or you lack `invoice.manage`                 | Check **Settings** → **Apps**, then your role |
| The Invoices page shows a permission error         | You lack `invoice.manage`                                    | Ask an Owner or Admin                         |
| The **Record payment** button is missing           | The invoice is a draft or void, or you lack `payment.record` | Check the status, then your capability        |
| The **Void invoice** item is missing               | Already void, or you lack `invoice.manage`                   | Check the status and your capability          |
| An upgrade prompt appears on the builder           | Your plan lacks `invoicing`                                  | Upgrade to Pro                                |
| An upgrade prompt appears on PDF export            | Your plan lacks `exports`                                    | Upgrade to Pro                                |
| You can see the list but not one client's invoices | Your supervision scope excludes that client                  | Ask an Owner or Admin to widen your scope     |

## Related guides

<CardGroup cols={2}>
  <Card title="Roles and capabilities" icon="shield-halved" href="/concepts/roles-and-capabilities">
    The full permission model.
  </Card>

  <Card title="Apps and modules" icon="toggle-on" href="/concepts/apps-and-modules">
    The app switch.
  </Card>

  <Card title="Plans and features" icon="badge-check" href="/concepts/plans-and-features">
    What Pro unlocks.
  </Card>

  <Card title="Rate permissions" icon="lock" href="/rates/rate-permissions">
    Why Finance sees no rates.
  </Card>

  <Card title="Invoicing overview" icon="file-invoice" href="/invoicing/overview">
    The whole flow.
  </Card>

  <Card title="Record a payment" icon="hand-holding-dollar" href="/invoicing/record-a-payment">
    What payment.record unlocks.
  </Card>
</CardGroup>