Teams & roles
Inviting people to a workspace, and what each role can do.
Roles
A workspace has three roles.
| Owner | Admin | Member | |
|---|---|---|---|
| Read projects, clients, keys | ✓ | ✓ | ✓ |
| Create and edit projects, clients, keys | ✓ | ✓ | |
| Manage teams and members | ✓ | ✓ | |
| Remove members | ✓ | ✓ | |
| Billing and licensing | ✓ | read-only | |
| Delete the workspace | ✓ |
Member is read-only. That is the point of it — someone who needs to see usage, read docs and inspect logs without the ability to mint credentials. Support engineers and analysts usually belong here.
Admin is the working role for people who run the API day to day. It can do everything except dispose of the workspace or change billing.
Owner additionally controls billing and can delete the workspace.
Inviting people
Workspace → Team → Invite. Invitations go out by email, so this needs SMTP configured. The invitee picks a role at acceptance, within what you offered.
If a licence sets a seat limit, the invite dialog shows the seats remaining and refuses once they are exhausted.
Teams
Projects belong to a team inside the workspace. A single default team is fine for a small installation; larger ones use teams so each group's projects stay separate without needing a workspace each.
Instance administrators
Orthogonal to all of the above. An admin flag on the user account grants /admin —
instance-wide settings for email, storage, sign-in providers,
the AI endpoint and licensing.
Being a workspace owner does not grant it, and an instance admin is not implicitly a member of every workspace. See Authentication.
Who should hold what
A layout that holds up:
- Instance admin — the one or two people who operate the deployment.
- Workspace owner — whoever is accountable for the API and its billing.
- Workspace admin — the engineers who issue keys and manage consumers.
- Member — everyone else who needs visibility.
The separation that matters most is the last one: read access to usage and logs is useful to far more people than the ability to issue credentials, and those two should not arrive together by default.