Roles & permissions

Scope dashboard access across owner, admin, operator, and member roles, and see how they differ from API keys.

Every dashboard user holds exactly one role, scoped to a team: owner, admin, operator, or member. A role determines which dashboard pages and actions a user can access; it has no effect on the Yield, Perps, or Borrow API, which authenticate with project-level API keys instead (see Distinguishing roles from API keys).

Roles

Role	Can do
Member	View projects, configuration, reports, and team membership. Export reports as CSV. Manage their own account security. Cannot create, edit, or delete anything.
Operator	Member, plus manage enabled yields (yield blocking), fees, geo-blocking, and webhooks. Cannot manage projects, API keys, payout wallets, custom RPC URIs, team members, or SSO.
Admin	Member, plus workspace management, enabled yields, fees, geo-blocking, payout wallets, webhooks, project management (including custom RPC URIs and Trade providers), API key management, and inviting or managing admins, operators, and members. Can view the SSO configuration but not change it.
Owner	Everything admin can do, plus configuring and enforcing SSO, and promoting or demoting other owners.

A team can have more than one owner. At least one owner must always exist: the last remaining owner cannot be demoted or removed.

Inviting and changing roles

An owner can invite any role (owner, admin, operator, or member) and change any user’s role. An admin can invite and reassign only admin, operator, and member; an admin cannot invite or assign the owner role, and cannot change an owner’s role. Operators and members cannot invite or manage other users.

To remove an owner from the team, first change their role to admin, operator, or member, then remove them; the same last-owner protection applies to removal as to demotion.

Distinguishing roles from API keys

Dashboard roles control what a logged-in person can do in the dashboard. They are separate from the credentials your integration uses to call yield.xyz’s APIs:

Credential	Scope	Who can manage it
Project API key (X-API-KEY)	Authenticates Yield, Perps, and Borrow API requests for one project	Admin and owner; all roles can view existing keys. See Projects & API keys.
Admin API key (X-ADMIN-API-KEY)	Authenticates the programmatic (admin-level) API for project and configuration automation	Admin and owner only, for both viewing and managing. See Programmatic access.

A dashboard role never grants direct API access on its own; it only governs the dashboard itself and who can create or rotate the keys above.

Next steps

Single sign-on (SSO)

Configure OIDC or SAML login for the team; owners manage it.

Programmatic access

What Admin API keys can automate, and how to create one.