Team & roles

Bring other people into your account and give each of them exactly as much access as they need, and no more. Every click is named below.

For the ideas behind it, see Team & roles; for the endpoints, see the API reference.

Getting to Account Settings

Everything in this guide happens on one page. Sign in and click Settings in the side panel, under Account, and you land on Account Settings.

It has seven tabs across the top, in this order: Profile, Notifications, Account, Team, Roles, API keys, Activity. You arrive on Profile. Three of them matter here: Team, Roles and API keys, and every section below starts from one of them.

1. Invite a member

1. On Account Settings, click the Team tab. You land on the Team Members table, with columns User, Email, Role, Status and Last Login.
2. Click Invite Member, at the top right of the table. The Invite Team Member dialog opens.
3. Fill in Username, First name, Last name and Email. Both the username and the email have to be unused across MicroApps, not just on your account, or you get "Username is already taken" or "Email is already in use".
4. Pick a Role. It opens on Read-only, and if you are not sure, leave it there - you can change it later, and least privilege is a good default. Each option in the list is tagged System or Custom.
5. Click Send Invite.

They get an email invitation, click the link, set their own password, and they are in. You never create or see a temporary password for them, and the account arrives already verified - you vouched for the address by typing it.

The new row appears in the table with a Member badge and their role name next to it, and a Status of Active.

Off, not gone

Need to cut someone's access for a while? Disable them from the Team tab instead of removing them. Their account stays, their access stops, and you can switch them back on later. Step 3 has the clicks.

2. Change someone's role

Each member has exactly one role, and it decides what they can do.

1. On the Team tab, click the member's username in the User column. The Member details dialog opens, listing their email, whether they are verified, their last login and the date they joined.
2. At the bottom of that list is a Role dropdown. Pick the new role.
3. Click Close.

There is no save button on that dropdown - picking a role applies it, and you get a "Member role updated" confirmation. The change takes effect on the member's next request.

The account Owner is the exception. Their row carries an Owner badge instead of a role name, they always have full access, and there is no dropdown to change.

3. Disable or remove a member

Both live in the actions column at the right-hand end of each member's row. Hover a button to see what it does.

To disable someone:

1. On the Team tab, find their row.
2. Click the Disable member button in the actions column.

The Status badge flips from Active to Disabled, and their sessions and their API keys stop working right away. The button becomes Enable member, which switches them back on. You can do the same from the Member details dialog, where the footer button reads Disable or Enable.

To remove someone for good:

1. Click the Remove member button in the actions column.
2. Confirm Remove in the Remove member dialog.

Removing a member also revokes every API key they created, so anything running on one of their keys stops immediately. There is no undo - re-inviting them builds a new account, not the old one.

You cannot disable or remove yourself, and neither can be done to the account Owner.

Who sees these buttons

The controls follow permissions, not job titles. Invite Member needs Create on Team members; the per-row Disable and Remove buttons need Update or Delete on it. A member without those sees the table and nothing else, and the Owner's row never shows them at all.

4. Create a custom role

The four system roles cover the common cases. When you need something more specific:

1. On Account Settings, click the Roles tab. You land on a grid of role cards, each badged System or Custom, showing its description and how many permissions it holds.
2. Click New role, at the top right. The New role dialog opens.
3. Type a Role name and, optionally, a Description.
4. Tick what the role should allow in the Permissions grid - see below for how to read it.
5. Click Create role.
6. Assign it: go back to the Team tab and change a member's role, as in step 2.

Reading the permissions grid

Each row is one resource: Pods, Networks, Firewalls, Domains, Snapshots, Backups, Email, SSH keys, Monitoring, Billing, Support, API keys, Roles, Team members, Account settings, Activity log.

Across each row sit its actions, as checkboxes. Most rows carry View, Create, Update and Delete. Some carry fewer, because the action does not exist on that resource:

Resource	Actions it actually has
SSH keys, API keys	View, Create, Delete
Support	View, Create, Update
Monitoring, Account settings	View, Update
Billing	View, Make payments
Activity log	View

Three actions are marked sensitive - Console access on Pods, Enable/disable SSL on Domains, Make payments on Billing. They are coloured differently and carry a small shield, so grant them deliberately rather than by sweeping a whole row.

Clicking the resource name itself toggles every action in that row at once. A dash in the resource checkbox means some actions are ticked but not all.

Team members, Roles and Account settings are in the grid like everything else, and a custom role can carry them. That is how you hand team administration to a trusted deputy without handing over the account. (API keys are a different story - see below.)

A worked example: a contractor

Someone who should deploy and debug your pods, and touch nothing else:

Resource	Tick
Pods	View, Create, Update, Console access
Snapshots	View, Create, Delete
Networks, Firewalls	View
Monitoring, Support	View
Everything else	nothing

That is Developer with domains, backups, SSH keys and pod deletion taken away. There is no button to duplicate a role and edit it, so you do tick these yourself - open View permissions on the Developer card first and use it as the checklist.

The limits

• You can only grant permissions you hold yourself. Try to exceed them and you get "A role cannot grant permissions beyond your own"; try to hand such a role to someone and you get "You cannot assign a role granting permissions beyond your own".
• The four system roles cannot be edited or deleted. If one is close but not quite right, build a custom role instead of trying to bend it.
• A custom role that is still assigned to someone cannot be deleted. Move those members onto another role first.

Edit or delete a custom role

1. On the Roles tab, find the card.
2. Click Edit role (the pencil) or Delete role (the trash). Both buttons appear only on cards badged Custom.
3. For an edit, change what you need and click Save changes. For a delete, confirm Delete.

Editing a role takes effect immediately for every member holding it - they do not need to sign out and back in.

What each system role can do

Role	Rough shape
Full access	Everything except managing team, roles, and account settings.
Developer	Pods, networks, firewalls, domains, snapshots, backups, SSH keys, monitoring, support; read-only email and activity log.
Read-only	View everything, change nothing.
Billing	Full billing and payments; read-only account and activity log.

Need the exact permission list behind each? It is in the API reference.

How API keys fit in

An API key carries permissions just like a member does, from the API keys tab of this same page. Two things to know while you are thinking about roles:

• A key's permissions are drawn from your own access. A key can never do something you cannot, and narrowing your role narrows every key you made.
• Team members, Roles and Account settings never appear in a key's permission grid. Those three are barred from API keys outright, including the Owner's. A custom role can grant them to a person; an API key can never hold them. Automate the resources, not the org chart.

Put a person on a tight role, and give their scripts an even tighter key. The API keys & automation guide has the clicks.

See also

• Team & roles concepts
• Team & roles API
• API keys & automation