Team & roles

Bring other people into your account and give each of them exactly as much access as they need, and no more. Every click is named below.

For the ideas behind it, see Team & roles; for the endpoints, see the API reference.

Getting to Account Settings

Everything in this guide happens on one page, Account Settings. It is the Settings entry in the side panel, under Account:

1. Sign in to the console.
2. Click Settings in the side panel, under Account. You land on Account Settings.

The page has seven tabs across the top, in this order: Profile, Notifications, Account, Team, Roles, API keys, Activity. You arrive on Profile. Three of them matter here: Team, Roles and API keys.

Every section below starts from this page. If you get lost, Settings in the side panel brings you back.

1. Invite a member

1. On Account Settings, click the Team tab. You land on the Team Members table, with columns User, Email, Role, Status and Last Login.
2. Click Invite Member, at the top right of the table. The Invite Team Member dialog opens.
3. Fill in Username, First name, Last name and Email.
4. Pick a Role. It opens on Read-only, and if you are not sure, leave it there - you can change it later, and least privilege is a good default. Each option in the list is tagged System or Custom.
5. Click Send Invite.

They get an email invitation, click the link, set their own password, and they are in. You never create or see a temporary password for them.

The new row appears in the table with a Member badge and their role name next to it. The Status column reads Active, and carries an extra Unverified badge for anyone who has not confirmed their email address.

Off, not gone

Need to cut someone's access for a while? Disable them from the Team tab instead of removing them. Their account stays, their access stops, and you can switch them back on later. Step 3 has the clicks.

2. Change someone's role

Each member has exactly one role, and it decides what they can do.

1. On the Team tab, click the member's username in the User column. The Member details dialog opens, listing their email, whether they are verified, their last login and the date they joined.
2. At the bottom of that list is a Role dropdown. Pick the new role.
3. Click Close.

There is no save button on that dropdown - picking a role applies it, and you get a "Member role updated" confirmation. The change takes effect on the member's next request.

The account Owner is the exception. Their row carries an Owner badge instead of a role name, they always have full access, and there is no dropdown to change.

3. Disable or remove a member

Both live in the actions column at the right-hand end of each member's row. Hover a button to see what it does.

To disable someone:

1. On the Team tab, find their row.
2. Click the Disable member button in the actions column.

The Status badge flips from Active to Disabled, and their sessions and their API keys stop working right away. The button becomes Enable member, which switches them back on. You can do the same from the Member details dialog, where the footer button reads Disable or Enable.

To remove someone for good:

1. Click the Remove member button in the actions column.
2. Confirm Remove in the Remove member dialog.

Removing a member also revokes every API key they created, so anything running on one of their keys stops immediately. There is no undo - re-inviting them builds a new account, not the old one.

You cannot disable or remove yourself, and neither can be done to the account Owner.

Who sees these buttons

Invite Member and the per-row actions are shown to the account Owner. A member looking at the Team tab sees the table, not the controls.

4. Create a custom role

The four system roles cover the common cases. When you need something more specific:

1. On Account Settings, click the Roles tab. You land on a grid of role cards, each badged System or Custom, showing its description and how many permissions it holds.
2. Click New role, at the top right. The New role dialog opens.
3. Type a Role name and, optionally, a Description.
4. Tick what the role should allow in the Permissions grid - see below for how to read it.
5. Click Create role.
6. Assign it: go back to the Team tab and change a member's role, as in step 2.

Reading the permissions grid

Each row is one resource: Pods, Networks, Firewalls, Domains, Snapshots, Backups, Email, SSH keys, Monitoring, Billing, Support, API keys, Roles, Team members, Account settings, Activity log.

Across each row sit its actions, as checkboxes: View, Create, Update, Delete, plus a few specials - Console access on Pods, Enable/disable SSL on Domains, Make payments on Billing. The specials are the sensitive ones. They are coloured differently and carry a small shield, so grant them deliberately rather than by sweeping a whole row.

Clicking the resource name itself toggles every action in that row at once. A dash in the resource checkbox means some actions are ticked but not all.

Team members, Roles and Account settings are in the grid like everything else, and a custom role can carry them. That is how you hand team administration to a trusted deputy without handing over the account. (API keys are a different story - see below.)

The limits

• You can only grant permissions you hold yourself, so you cannot accidentally build a role more powerful than you are. Try it and you get "A role cannot grant permissions beyond your own".
• The four system roles cannot be edited or deleted. Click the View permissions button on a card to read exactly what one grants. If one is close but not quite right, build a custom role instead of trying to bend it.
• A custom role that is still assigned to someone cannot be deleted. Move those members onto another role first.

Edit or delete a custom role

1. On the Roles tab, find the card.
2. Click Edit role (the pencil) or Delete role (the trash). Both buttons appear only on cards badged Custom.
3. For an edit, change what you need and click Save changes. For a delete, confirm Delete.

Editing a role takes effect immediately for every member holding it - they do not need to sign out and back in.

What each system role can do

Role	Rough shape
Full access	Everything except managing team, roles, and account settings.
Developer	Pods, networks, firewalls, domains, snapshots, backups, SSH keys, monitoring, support; read-only email and activity log.
Read-only	View everything, change nothing.
Billing	Full billing and payments; read-only account and activity log.

Need the exact permission list behind each? It is in the API reference.

How API keys fit in

An API key is a credential for scripts and automation, and it carries permissions just like a member does. You create one from the API keys tab of this same Account Settings page - the API keys & automation guide walks through it.

Two things to know while you are thinking about roles:

• A key's permissions are drawn from your own access. A key can never do something you cannot.
• Team members, Roles and Account settings never appear in a key's permission grid. Those three resources are barred from API keys outright, whoever created the key, including the Owner's. A custom role can grant them to a person; an API key can never hold them. Automate the resources, not the org chart.

A good pattern: put a person on a tight role, and give their scripts an even tighter API key.

See also

• Team & roles concepts
• Team & roles API
• API keys & automation