Two different things, and picking the wrong one is the usual source of confusion.

They need to work in Mokka → invite them as a user

Go to Settings → Send invite, type their email, click Send invite.

They get an email, set a password, and land in your workspace with access to your company's roles and candidates. You'll see them under Settings → Users → Workspace users, with their name, email and role.

Pending invites sit in the same place until accepted. Each one shows when it expires, and says Expired once it has — send a new one if that happens. If it says Bounced, the email never arrived: check the address for a typo before resending.

They only need to read one candidate's report → hiring manager access

A hiring manager who just needs to look at a shortlist doesn't need a seat.

Under Settings → Users → Hiring manager access, turn on Let hiring managers open reports without a seat. After that, anyone with an email on your company's verified domain can open a candidate report by entering a one-time code sent to that email.

Three things worth knowing before you turn it on:

  • It applies to your whole verified domain. Anyone with a company-domain email can give themselves access. If that isn't what you want, leave it off and invite people individually.
  • It only affects links generated afterwards. Report links already posted to your ATS keep working the way they did.
  • Turning it off stops new sign-ins, not current ones. Anyone already signed in keeps access until their session expires.

It only works if your company has a verified email domain set. If the toggle does nothing, that's usually why.

Which one do I want?

They need to Give them
Review candidates, move stages, run roles A user invite
Read a candidate report you sent them Hiring manager access
Read reports, but only some people should A user invite — hiring manager access is domain-wide