Prerequisites
The owner or admin role. Operators and members can view the team page but can’t invite, change roles, or remove anyone.Invite a teammate
Click Invite, enter their email, and pick a role. Which roles you can offer depends on your own:
An admin can’t invite an owner. Only an owner can hand out the owner role.
Change a teammate’s role
Open a member row’s actions and choose Update role. The roles you can move them to follow the same split as inviting: an owner can set any role on any other member; an admin can set admin, operator, or member on another admin, operator, or member, and can’t touch an owner’s role at all.Remove a teammate
Open a member row’s actions and choose Remove. This immediately revokes dashboard access and deactivates any API keys tied to their account. The same role split applies: an owner can remove an admin, operator, or member; an admin can remove an admin, operator, or member; neither can remove a user who currently holds the owner role directly.To remove someone who is currently an owner, first change their role to admin, operator, or member with Update role, then remove them.
Last-owner protection
A team must always keep at least one owner. Demoting or removing the last remaining owner is rejected outright, whether attempted through role change or removal. Promote a second owner first if you need to step the original one down.SSO exemption
While SSO is enforced for the team, a member row also offers Exempt from SSO / Remove SSO exemption, letting a specific person keep signing in with an email code. See Set up SSO.Dashboard roles vs. API keys
A dashboard role only controls what a signed-in person can do in the dashboard. It has no bearing on API authentication:
See Projects & API keys and Programmatic access for each.
Next steps
Roles & permissions
The full permission matrix for each role.
Set up SSO
Configure single sign-on and the break-glass exemption.