Setting up a BrightStar account properly at the start saves you trouble later — at the door of a kirtan, at a retreat check-in table, or at a festival gate where dozens of volunteers need different kinds of access at once. This guide walks through the full sequence: what BrightStar needs from you to open an account, how to build out your organizer profile, how team access levels work, and how to keep the account secure once real ticket revenue and attendee data are flowing through it.
What information do you need to open a BrightStar account?
BrightStar asks for a specific set of details before your account is usable, and each one serves a purpose beyond paperwork. A verified email confirms the account belongs to a real, reachable person. Your organization name is what attendees see on your event pages, so it's worth entering exactly as you want it public. The business address and tax identification exist because BrightStar processes payments through Stripe, and Stripe requires verified business information before it will move money on your behalf — this is the same reason nearly every payment platform asks for it, not a BrightStar-specific hurdle.
- Valid email address (verified via confirmation link)
- Organization name (displayed on event pages)
- Primary contact phone number
- Business address (required for Stripe verification)
- Tax identification (EIN for US, VAT for EU)
Setting up your organizer profile
Once your account exists, your profile is what attendees actually encounter when they land on one of your event pages. A few of these settings have effects that reach further than they first appear:
- 1Upload an organization logo, at least 400x400px, in PNG or JPG — this appears anywhere your branding shows up on event pages
- 2Add an organization description, which is pulled into event footers automatically
- 3Set your default timezone — this is the one setting that affects all of your event times, so a retreat scheduled across a change of season or a workshop listed for attendees in another region will display correctly only if this is set right the first time
- 4Configure notification preferences for email and SMS so you're not missing check-in issues or sales alerts
- 5Add your social media links, which display on your event pages
Who should have which level of access at your events
A festival gate crew, a retreat's finance person, and the owner managing billing all need very different things from the same account, which is why BrightStar splits access into four levels. Owner is the only level with full account access, including billing management, team member management, and API key generation — this stays narrow on purpose, since billing and API keys are the two things that cause the most damage if mishandled. Admin can create, edit, and delete events, process refunds, and view all reports, but cannot touch billing, so someone can run the operational side of your events without ever being able to move money out of the account. Manager can create and edit events and see reports for the events they're assigned to, but cannot delete events, which suits someone running a single retreat or workshop series without giving them reach into everything else you run. Scanner is the narrowest: check-in access and attendee lists only, with no financial access at all — exactly what you'd hand a volunteer standing at a kirtan door with nothing more than a device to scan tickets.
Keeping your account secure
Because an organizer account holds attendee data and a path to your payment processing, BrightStar recommends a small set of security habits rather than leaving it to chance. Two-factor authentication, whether by TOTP app or SMS, means a stolen password alone isn't enough to get in. Session timeout — 24 hours by default — limits how long a login stays valid on a device that's lost or left unattended. An IP allowlist for API access is optional, useful if your API calls only ever come from a known server or office network. Reviewing login history monthly and rotating API keys quarterly are both about catching something that's gone wrong before it becomes a bigger problem, rather than after.
- Enable two-factor authentication (TOTP or SMS)
- Set session timeout (default: 24 hours)
- Configure IP allowlist for API access (optional)
- Review login history monthly
- Rotate API keys quarterly