Docs · Organizations
Roles & permissions
What an organization admin can do, what a member can do, and how a personal space differs.
Every person in an organization is either an admin or a member. A personal space has just you, with the abilities of an admin where they apply.
What each role can do#
| Personal space | Organization admin | Organization member | |
|---|---|---|---|
| Use the API with a key they own | ✓ | ✓ | ✓ |
| See their own keys and usage | ✓ | ✓ | ✓ |
| See all keys in a workspace | ✓ | ✓ | |
| Create, edit, and delete API keys | ✓ | ✓ | |
| Create, rename, and delete workspaces | ✓ | ✓ | |
| View the Workspaces page | ✓ | ✓ | read-only |
| View Credits and add credits | ✓ | ✓ | |
| Set budgets | ✓ | ✓ | |
| View organization Analytics | ✓ | ||
| Invite, remove, and change roles of members | ✓ | ||
| Rename the organization, change its icon | ✓ | ||
| Set Access defaults, such as the data-policy floor | ✓ | ✓ |
Pages a role cannot use are hidden from the sidebar. If someone opens a link to one anyway, the console shows a message that the page is not available to them, not an error.
Notes#
- Members do not manage keys. Only admins create, edit, and delete keys, including keys that belong to a member. A member can see and use the keys they own.
- There is no separate owner role. The person who created an organization is an admin like any other. The only protection is that an organization always keeps at least one admin.
- Billing access follows admin. There is no separate billing role.
- Hiding a page is not the only check. The API also checks permissions on every action.
Before you open a link someone sent you#
A link to an organization page only works if you belong to that organization. If you were removed, or you are signed in as a different account, the page shows which account you are signed in as, so you can switch accounts.