Organization and team
Your organization holds your products, their licenses and customers, your API keys and your subscription. Everyone working on them joins the organization as a member, with a role deciding what they can do: your support team can manage licenses without touching your billing, and your accountant can look at the numbers without changing anything.
You can belong to several organizations, for example one per company you work for. The product switcher at the top of the sidebar lists the products of all of them.
Invite a member
Open the team
In the sidebar, click Team. Only owners and admins see it.
Send the invitation
Click Invite member, enter their email and pick their role.
They accept it
They receive an email with a link to join. They sign up with this email, or log in when they already have an account, and land in the organization.
Pending invitations are listed in the Invitations tab, where you can revoke them. An invitation expires after 48 hours: invite them again if it did.
Members and pending invitations both count as seats of your plan. See plans and billing.
Roles and permissions
There are four roles, from the most to the least privileged:
- Owner: everything, including deleting the organization and managing the other owners. The member who created the organization is its first owner.
- Admin: everything, except deleting the organization and managing owners. Admins manage the team, the API keys and the subscription.
- Member: the day-to-day work on your products. Members create and change products, policies, releases, customers, licenses, machines, portal links and integrations, but can’t see the team or API keys pages, or change the subscription and the organization’s settings.
- Viewer: read-only. Viewers see everything members see, but can’t change anything.
| Owner | Admin | Member | Viewer | |
|---|---|---|---|---|
| See products, licenses, customers, stats and usage | ✓ | ✓ | ✓ | ✓ |
| Create, change and delete products, policies and releases | ✓ | ✓ | ✓ | |
| Create, change and delete customers and licenses, send keys, deactivate machines | ✓ | ✓ | ✓ | |
| Create and send portal links, and create scoped tokens | ✓ | ✓ | ✓ | |
| Connect Stripe and manage price mappings | ✓ | ✓ | ✓ | |
| Create and revoke API keys | ✓ | ✓ | ||
| Invite, remove members and change their role | ✓ | ✓ | ||
| Change the plan and payment details | ✓ | ✓ | ||
| Rename the organization | ✓ | ✓ | ||
| Invite, remove and change owners | ✓ | |||
| Delete the organization | ✓ |
The app only shows what your role allows: a viewer doesn’t see the buttons creating or editing things, and members don’t see the Team and API keys pages. The API enforces the same rules: a request your role doesn’t allow is refused with 403 and the insufficient_role error code.
Your role in the organization is shown at the top of the menu under your name, at the bottom of the sidebar.
Roles limit what people do in the app. API keys aren’t tied to anyone: they act for the whole organization, whoever created them. Only give them to the systems that need them, and revoke the ones you no longer use.
Change a member’s role
In Team, open the menu of the member, click Change role, pick the new role and save. The change applies to their next request; they see the menus of their new role once they reload the app.
Admins can’t change the role of owners, nor make someone an owner: ask an owner.
Remove a member
In Team, open the menu of the member and click Remove. They lose access to the organization right away, including the sessions they have open. What they created, like licenses or API keys, stays.
Edge cases
The last owner. An organization always keeps an owner: the last owner can’t be removed nor lose the owner role. Make someone else an owner first.
Changing your own role. You can’t change your own role or remove yourself from the Team page: ask another owner or admin.
Several roles. A member can have several roles, for example when set through the API: they can do everything any of their roles allows.
Test products. Roles apply to test products like to live ones. Test products only email the members of the organization, whatever their role: see test mode.