Team and roles

Who can do what in your workspace, and how invitations work.

Everyone in a workspace has one of four roles. The console only shows each person what their role allows, and the API refuses the rest.

Roles

In short:

• Owner: everything, including billing and other owners.
• Admin: projects, production, keys and people. Not owners, not billing changes.
• Developer: build and configure projects. Not production setup, deletes or people.
• Viewer: read-only. Useful for support and stakeholders.

A person can hold a different role in each workspace they belong to. The workspace switcher shows your role in each one.

Invitations

Owners and admins invite people from Team, choosing their role.

• The invitation is sent by email and expires after 72 hours.
• It must be accepted while signed in with the address it was sent to. A forwarded invitation cannot be accepted by someone else.
• Nobody is added automatically. The invited person sees the invitation when they sign in and chooses to accept or decline.
• Owners and admins can revoke an invitation that has not been accepted.

Rules that protect the workspace

• Only an owner can make someone an owner. An admin cannot invite or promote anyone to owner.
• An admin cannot change or remove an owner.
• The last owner cannot leave or be removed. Make someone else an owner first.
• Anyone can leave a workspace themselves.

Seats

Each plan includes a number of seats. Members and pending invitations both count, so an invitation holds its seat until it is accepted, declined, revoked or expires.

Inviting past the limit is refused with code plan_limit_seats. After a downgrade, nobody is removed, but nobody new can join until you are under the limit.

Updated at, Sunday, November 1, 2026