Team roles and permissions
What each team role can do in the app versus what an API key scope allows.
Team roles control dashboard access for signed-in users. API key scopes control programmatic access — they are independent.
Roles at a glance
| Role | Typical use | Members & invites | Billing | API keys | Team audit log |
|---|---|---|---|---|---|
| Owner | Account owner | Full | Full | Full | Yes |
| Admin | Day-to-day administration | Full | Full | Full | Yes |
| Member | Standard teammate | Read only | Read | Read keys only | No |
| Billing | Finance / subscriptions | No | Read & update | No | No |
Owner & Admin
Owners and admins can invite members, change roles, manage billing, configure notifications, view the team audit log, and create or revoke API keys with any scopes they select.
Member
Members can read team and billing information and view existing API keys. They cannot invite users, change roles, create API keys, or open Team → Security (the team audit log requires the security:read permission, which Members do not have).
Billing
The Billing role can read and update subscription data and read basic account information. They cannot manage members, API keys, or the team audit log.
API keys vs roles
A key only has the scopes chosen at creation time. A Member who cannot create keys in the UI might still use a key an Admin issued — the key's scopes define what the integration can call.
When designing integrations, use the smallest scope set that satisfies the workflow. Cross-check scopes in API key scopes and endpoint requirements in the API reference.
Related articles
- Audit log — where to find team and personal logs
- Audit log events — what each action label means
- API key scopes — programmatic permissions