Team roles and permissions
What each team role can do in the app versus what an API key scope allows.
Loading article…
Team roles control dashboard access for signed-in users. API key scopes control programmatic access — they are independent.
| Role | Typical use | Members & invites | Billing | API keys | Team audit log |
|---|---|---|---|---|---|
| Owner | Account owner | Full | Full | Full | Yes |
| Admin | Day-to-day administration | Full | Full | Full | Yes |
| Member | Standard teammate | Read only | Read | Read keys only | No |
| Billing | Finance / subscriptions | No | Read & update | No | No |
Owners and admins can invite members, change roles, manage billing, configure notifications, view the team audit log, and create or revoke API keys with any scopes they select.
Members can read team and billing information and view existing API keys. They cannot invite users, change roles, create API keys, or open Team → Security (the team audit log requires the security:read permission, which Members do not have).
The Billing role can read and update subscription data and read basic account information. They cannot manage members, API keys, or the team audit log.
A key only has the scopes chosen at creation time. A Member who cannot create keys in the UI might still use a key an Admin issued — the key's scopes define what the integration can call.
When designing integrations, use the smallest scope set that satisfies the workflow. Cross-check scopes in API key scopes and endpoint requirements in the API reference.