Every person in an organization is either an **admin** or a **member**. A personal space has just you, with the abilities of an admin where they apply.

## What each role can do

| | Personal space | Organization admin | Organization member |
|---|:--:|:--:|:--:|
| Use the API with a key they own | ✓ | ✓ | ✓ |
| See their own keys and usage | ✓ | ✓ | ✓ |
| See all keys in a workspace | ✓ | ✓ | |
| Create, edit, and delete API keys | ✓ | ✓ | |
| Create, rename, and delete workspaces | ✓ | ✓ | |
| View the Workspaces page | ✓ | ✓ | read-only |
| View Credits and add credits | ✓ | ✓ | |
| Set budgets | ✓ | ✓ | |
| View organization Analytics | | ✓ | |
| Invite, remove, and change roles of members | | ✓ | |
| Rename the organization, change its icon | | ✓ | |
| Set Access defaults, such as the data-policy floor | ✓ | ✓ | |

Pages a role cannot use are hidden from the sidebar. If someone opens a link to one anyway, the console shows a message that the page is not available to them, not an error.

## Notes

- **Members do not manage keys.** Only admins create, edit, and delete keys, including keys that belong to a member. A member can see and use the keys they own.
- **There is no separate owner role.** The person who created an organization is an admin like any other. The only protection is that an organization always keeps at least one admin.
- **Billing access follows admin.** There is no separate billing role.
- **Hiding a page is not the only check.** The API also checks permissions on every action.

## Before you open a link someone sent you

A link to an organization page only works if you belong to that organization. If you were removed, or you are signed in as a different account, the page shows which account you are signed in as, so you can switch accounts.