Skip to main content
Team lives at Settings, Team. The old /app/team address redirects there. There are five roles. A workspace has one owner. The owner moves only by an ownership transfer. You cannot invite someone as owner. An invite email stays valid for 7 days (InvitationTTL). After that the row is expired. You can resend it, which issues a new link, or revoke it. Revoked wins over accepted: a revoked invite is not usable. Invite statuses: pending, accepted, expired, revoked.

​
Permissions

This matrix is the source of truth. Roles do not inherit. A blank cell is denied. What those tokens allow: Support is on every role, including viewer. A ticket does not grant any other permission.

​
Who can invite whom

Inviting and role changes need members.write, so only the owner and an admin see the invite form. You can grant a role only when every permission of that role is a permission you already have. You cannot grant owner.
  • Owner can invite admin, finance, member, and viewer.
  • Admin can invite member and viewer. Admin cannot invite finance, because finance can change billing and admin cannot. Admin cannot remove another admin. Only the owner can remove an admin.
  • Finance, member, and viewer can see the team and cannot invite.
The owner can transfer ownership to another member. That needs workspace.transfer. The target becomes owner and the previous owner becomes admin, in one step.

​
What a customer can do in each role

Owner. Full access, including billing changes and transferring ownership. Two-factor authentication is required, with 14 days to set it up. See Settings. Admin. Everything except billing changes and ownership transfer. Can invite members and viewers, read KYC, and read the audit feed. Finance. Balance, purchases, payment methods, and auto top-up (billing.read and billing.write), plus logs and support. Cannot manage API keys, webhooks, or settings. Two-factor authentication is required, with the same 14 days. Member. API keys, webhooks, and logs. Can read billing and cannot change it. Cannot change settings or invite people. Viewer. Read logs, API keys, billing, and the team. Can open and reply to support tickets. Cannot create keys, change webhooks, buy credits, or invite.