> ## Documentation Index
> Fetch the complete documentation index at: https://yieldxyz.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles & permissions

> Scope dashboard access across owner, admin, operator, and member roles, and see how they differ from API keys.

Every dashboard user holds exactly one role, scoped to a team: **owner**, **admin**, **operator**, or **member**. A role determines which dashboard pages and actions a user can access; it has no effect on the Yield, Perps, or Borrow API, which authenticate with project-level API keys instead (see [Distinguishing roles from API keys](#distinguishing-roles-from-api-keys)).

## Roles

| Role | Can do |
| - | - |
| **Member** | View projects, configuration, reports, and team membership. Export reports as CSV. Manage their own account security. Cannot create, edit, or delete anything. |
| **Operator** | Member, plus manage enabled yields (yield blocking), fees, geo-blocking, and webhooks. Cannot manage projects, API keys, payout wallets, custom RPC URIs, team members, or SSO. |
| **Admin** | Member, plus workspace management, enabled yields, fees, geo-blocking, payout wallets, webhooks, project management (including custom RPC URIs and Trade providers), API key management, and inviting or managing admins, operators, and members. Can view the SSO configuration but not change it. |
| **Owner** | Everything admin can do, plus configuring and enforcing SSO, and promoting or demoting other owners. |

A team can have more than one owner. At least one owner must always exist: the last remaining owner cannot be demoted or removed.

## Inviting and changing roles

An owner can invite any role (owner, admin, operator, or member) and change any user's role. An admin can invite and reassign only admin, operator, and member; an admin cannot invite or assign the owner role, and cannot change an owner's role. Operators and members cannot invite or manage other users.

To remove an owner from the team, first change their role to admin, operator, or member, then remove them; the same last-owner protection applies to removal as to demotion.

## Distinguishing roles from API keys

Dashboard roles control what a logged-in person can do in the dashboard. They are separate from the credentials your integration uses to call yield.xyz's APIs:

| Credential | Scope | Who can manage it |
| - | - | - |
| **Project API key** (`X-API-KEY`) | Authenticates Yield, Perps, and Borrow API requests for one project | Admin and owner; all roles can view existing keys. See [Projects & API keys](/documentation/get-started/projects-api-keys). |
| **Admin API key** (`X-ADMIN-API-KEY`) | Authenticates the programmatic (admin-level) API for project and configuration automation | Admin and owner only, for both viewing and managing. See [Programmatic access](/documentation/advanced-setup/programmatic-access). |

A dashboard role never grants direct API access on its own; it only governs the dashboard itself and who can create or rotate the keys above.

## Next steps

<Columns cols={2}>
  <Card title="Single sign-on (SSO)" icon="right-to-bracket" href="/documentation/advanced-setup/sso">
    Configure OIDC or SAML login for the team; owners manage it.
  </Card>

  <Card title="Programmatic access" icon="terminal" href="/documentation/advanced-setup/programmatic-access">
    What Admin API keys can automate, and how to create one.
  </Card>
</Columns>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.