#Members and roles

Everyone who can sign in to your organization is a member of it, and every member holds one of two roles.

The person who created the organization is its owner. Everyone else starts as a member until an owner says otherwise.

There is deliberately no long list of permissions behind these two words. Roles answer the question "who administers this account", not "which screens may this person open". If you need to narrow what an integration can reach, that is what an API key's permissions are for. See Authentication.

#Seeing who is in your organization

Settings → Members lists everyone, with their avatar, their role and the date they joined. Your own row is marked. Avatars come from each person's own profile settings. Every member can read the list; only an owner can change it.

#Changing someone's role

An owner opens the actions menu at the end of a member's row, chooses Change role, picks the new role and saves. The change takes effect on that person's next request, so they do not have to sign out and back in.

Two things the screen will not let you do:

• Leave the organization with no owner. The last owner cannot be changed to a member or removed, including by themselves. Make someone else an owner first, then change your own role.
• Change a role you do not own. A member who tries gets a message saying to ask an owner.

#Adding someone

An owner invites people by email. On Settings → Members, choose Invite member, enter the address, pick the role they should hold, and send. The person gets an email with a link to accept; the invitation expires after 48 hours.

While an invitation is waiting it appears under Pending invitations, with who sent it and when it expires. From the row's actions menu an owner can Resend it (which cancels the old link and emails a fresh one) or Cancel it. Inviting an address that already has a pending invitation also replaces the old one rather than stacking a second.

Clicking the emailed link asks the person to sign in, or to create an account with the same magic-link flow everyone uses, and then shows the organization's name with an accept or decline choice. Accepting adds them to the organization with the invited role and opens the dashboard. An invitation can only be accepted by a signed-in, verified account that holds the invited address.

Your plan caps how many people an organization holds and how many invitations can wait at once. If you hit either cap, the message says what to remove or cancel first.

#Removing someone

An owner opens the actions menu at the end of a member's row and chooses Remove from organization, then confirms. The person loses access immediately. The last owner cannot be removed, the same as with role changes, and owners can remove themselves as long as another owner remains.

Removing members still works while an account is past due or canceled, so you can shrink your team under a smaller plan's seat cap before downgrading.

#Roles and API keys

An API key is not a person, so it holds no role. It acts for the whole organization and is limited by its own permissions instead, which is why the members screen is closed to keys: a key can never promote itself or anyone else. The same is true of an OAuth connection, such as an MCP client.

GET /organization tells you which role the signed-in user holds, and returns null for that field when the request was authenticated with a key or an OAuth token.