> ## Documentation Index
> Fetch the complete documentation index at: https://yieldxyz.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage team roles

> Invite teammates with the right role, change a role, and remove access, including the last-owner protection.

Invite, promote, demote, and remove dashboard users from the **Team** page. This guide covers those actions. See [Roles & permissions](/documentation/advanced-setup/roles-permissions) for what each role, owner, admin, operator, or member, can actually do.

## Prerequisites

The owner or admin role. Operators and members can view the team page but can't invite, change roles, or remove anyone.

## Invite a teammate

Click **Invite**, enter their email, and pick a role. Which roles you can offer depends on your own:

| Your role | Can invite |
| - | - |
| Owner | Owner, admin, operator, member |
| Admin | Admin, operator, member |
| Operator, member | Cannot invite |

An admin can't invite an owner. Only an owner can hand out the owner role.

## Change a teammate's role

Open a member row's actions and choose **Update role**. The roles you can move them to follow the same split as inviting: an owner can set any role on any other member; an admin can set admin, operator, or member on another admin, operator, or member, and can't touch an owner's role at all.

## Remove a teammate

Open a member row's actions and choose **Remove**. This immediately revokes dashboard access and deactivates any API keys tied to their account. The same role split applies: an owner can remove an admin, operator, or member; an admin can remove an admin, operator, or member; neither can remove a user who currently holds the owner role directly.

<Note>
  To remove someone who is currently an owner, first change their role to admin, operator, or member with **Update role**, then remove them.
</Note>

## Last-owner protection

A team must always keep at least one owner. Demoting or removing the last remaining owner is rejected outright, whether attempted through role change or removal. Promote a second owner first if you need to step the original one down.

## SSO exemption

While SSO is enforced for the team, a member row also offers **Exempt from SSO** / **Remove SSO exemption**, letting a specific person keep signing in with an email code. See [Set up SSO](/guides/enterprise/sso-setup#set-a-break-glass-exemption).

## Dashboard roles vs. API keys

A dashboard role only controls what a signed-in person can do in the dashboard. It has no bearing on API authentication:

| Credential | What it authenticates | Who manages it |
| - | - | - |
| Project API key (`x-api-key`) | Yield, Perps, and Borrow API requests | Admin and owner |
| Admin API key (`X-ADMIN-API-KEY`) | Programmatic configuration routes | Admin and owner |

See [Projects & API keys](/documentation/get-started/projects-api-keys) and [Programmatic access](/guides/enterprise/programmatic-access) for each.

## Next steps

<Columns cols={2}>
  <Card title="Roles & permissions" icon="user-shield" href="/documentation/advanced-setup/roles-permissions">
    The full permission matrix for each role.
  </Card>

  <Card title="Set up SSO" icon="right-to-bracket" href="/guides/enterprise/sso-setup">
    Configure single sign-on and the break-glass exemption.
  </Card>
</Columns>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.