Team roles and permissions
What each team role can do in the app versus what an API key scope allows.
Team roles control dashboard access for signed-in users. API key scopes control programmatic access — they are independent.
Roles at a glance
| Role | Typical use | Members & invites | Billing | API keys | Team audit log | Email policy |
|---|---|---|---|---|---|---|
| Owner | Account owner | Full | Full | Full | Yes | Full |
| Admin | Day-to-day administration | Full | Full | Full | Yes | Full |
| Member | Standard teammate | Read only | Read | Read keys only | No | Read only |
| Billing | Finance / subscriptions | No | Read & update | No | No | Read only |
Owner & Admin
Owners and admins can invite members, change roles, manage billing, configure notifications, view the team audit log, create or revoke API keys with any scopes they select, and edit team email policy overlay rules.
Member
Members can read team and billing information, view existing API keys, and list email policy rules. They cannot invite users, change roles, create API keys, edit email policy, or open Team → Security (the team audit log requires the security:read permission, which Members do not have).
Billing
The Billing role can read and update subscription data and read basic account information, including listing email policy rules. They cannot manage members, API keys, the team audit log, or edit email policy.
API keys vs roles
A key only has the scopes chosen at creation time. A Member who cannot create keys in the UI might still use a key an Admin issued — the key's scopes define what the integration can call.
When designing integrations, use the smallest scope set that satisfies the workflow. Cross-check scopes in API key scopes and endpoint requirements in the API reference.
Related articles
- Audit log — where to find team and personal logs
- Audit log events — what each action label means
- API key scopes — programmatic permissions
- Team email policy — detect overlay rules