## Creating and Managing Users

This guide walks through how to **create and manage users** via the Medplum App and via API. Medplum supports multiple authentication options, but always maintains a representation of the user identities, and gives developers control over which authentication method to use for an identity, as well as what access controls are applied.

## Background: User Model

Medplum has several resources that represent user identities. The following resources are fundamental to building a correctly functioning application. This table describes how identities are represented in the system, and provides links to the administrative settings in the [Medplum App](https://app.medplum.com/).

| Resource | Description | Medplum App |
| --- | --- | --- |
| [`User`](/content/docs/api/fhir/medplum/user/index.html) | A resource that represents a user identity. Users exist above the Project level and can only be self-updated. | None |
| [`Project`](/content/docs/api/fhir/medplum/project/index.html) | A [Project](/content/docs/tutorials/register#medplum-projects/index.html) is an isolated set of resources. See the [Projects guide](/content/docs/access/projects/index.html) | [Project Admin](https://app.medplum.com/admin/project) |
| [`ProjectMembership`](/content/docs/api/fhir/medplum/projectmembership/index.html) | A ProjectMembership represents granting a user access to the resources within a Project. Inviting a user to a project, and specifying their `profile` and `accessPolicy` you can determine what set of resources they can access. | [Invite (Admins only)](https://app.medplum.com/admin/invite), [Users (Admins only)](https://app.medplum.com/admin/users) |

### Users

The [User](/content/docs/api/fhir/medplum/user/index.html) resource is the main resource that represents digital identity during authentication.

[Users](/content/docs/api/fhir/medplum/user/index.html) can have two different scopes, `server` or `project`:

- [Server scoped users](/content/docs/user-management/project-vs-server-scoped-users#server-scoped-users/index.html) tend to be administrators and developers that need to access multiple projects.
- [Project scoped users](/content/docs/user-management/project-vs-server-scoped-users#project-scoped-users/index.html) tend to be clinicians and patients that only need access to a single project.

### Profiles

_Within_ each project, a project member is represented by a specific FHIR resource, known as their **profile**. The `ProjectMembership.profile` element links the [`ProjectMembership`](/content/docs/api/fhir/medplum/projectmembership/index.html) to the profile resource.

A user's profile can be one of the three resource types in the table below. Incorporating the resources in the table below into ProjectMembership enable sophisticated access controls, as [Access Policies](/content/docs/access/access-policies/index.html) can access the profile of the current user.

| Resource | Description | Medplum App |
| --- | --- | --- |
| [`Patient`](/content/docs/api/fhir/resources/patient/index.html) | Patient is a fundamental FHIR resource and linking it to an identity allows the simple use case of granting access to personal records. | [Patients](https://app.medplum.com/Patient) |
| [`Practitioner`](/content/docs/api/fhir/resources/practitioner/index.html) | Practitioners are staff members of a healthcare organization and generally have access to multiple patients' data. | [Practitioner](https://app.medplum.com/Practitioner) |
| [`RelatedPerson`](/content/docs/api/fhir/resources/relatedperson/index.html) | RelatedPerson is a family member or caregiver of a patient, who may be granted access to a small number of patient records. | [RelatedPerson](https://app.medplum.com/RelatedPerson) |

There are several `ProjectMembership.profile` resources that are related to programmatic access, which serve as modifiers to the ProjectMembership resource (i.e. `ProjectMembership.profile`) and do not represent people, but rather applications that access data. This table describes the programmatic access profiles with links on where to set them up in the Medplum App.

| Resource | Description | Medplum App |
| --- | --- | --- |
| ClientApplication | API Keys that allow programmatic access to resources | [Client Applications](https://app.medplum.com/admin/clients) |
| Bot | Event driven [custom functions](/content/docs/bots/bot-basics/index.html) | [Bots](https://app.medplum.com/Bot) |

## Creating a New Project

### UI

The simplest way to create a project is to visit [https://app.medplum.com/register](https://app.medplum.com/register) and fill out the new project registration form.

### API

To create a new `Project` resource via the API, you will need to create a `ClientApplication` with super admin privileges.

```ts
await medplum.createResource({
  resourceType: 'Project',
  name: 'ProjectName',
  strictMode: true,
});
```

```bash
medplum post Project '{