Team & roles
Invite people, give them a role, and group keys and spend into teams.
An organization holds the credit balance, the keys, the guardrails and the people who use them. You manage people under Team in the console.
Roles
Every member has exactly one role.
| Role | Can do |
|---|---|
| Owner | Everything, including billing (top-ups, auto top-up, payment methods) and deleting the organization. There is exactly one owner: the person who created the organization. |
| Admin | Runs the platform day to day: guardrails, routing policies and privacy settings, inviting and removing people, organization settings, and every key in the organization. No billing, no deleting the organization. |
| Member | Creates API keys and manages the ones they created, sees usage and logs. Cannot change billing, policies or other people's keys. |
Admins have no billing rights on purpose. Whoever can raise the auto top-up cap can spend without limit, which is a different kind of trust than running the platform.
The owner cannot be demoted or removed. To leave the organization as its last member, delete your account under Profile, which deletes the organization with it (see Privacy & retention).
Inviting people
Owners and admins invite people by email and choose the role (admin or member). The invitation link is valid for 7 days. Pending invitations are listed on the Team page and can be cancelled there. Changing a role or removing a member takes effect immediately.
Teams
A team groups members and keys, so spend can be attributed and capped by department or product.
- Owners and admins create, rename and delete teams and assign members and keys to them.
- A key belongs to at most one team. Keys without a team are not covered by any team budget.
- Deleting a team never deletes or disables its keys. They keep working without a team.
- Spend per team appears in the activity view when you group by team.
Team budgets
Owners and admins can give a team a budget per day, week or month with two optional thresholds:
- Alert at: owners and admins get an email once per window when the team's spend reaches this amount.
- Block at: once reached, every key in the team returns
429 spend_limit_exceededuntil the window resets.
The alert threshold must not be higher than the block threshold, otherwise it could never fire. Windows reset at midnight UTC, on Monday, or on the first of the month. See Budgets & spend limits for how team budgets combine with key and guardrail limits.
Every change to members, roles, invitations and teams is written to the audit log.