Teams & roles

Roles

• Member. Day-to-day operations. Can read everything, and create or change anything that can be recreated: servers, sites, deploys and rollbacks, daemons, cron entries, firewall rules, monitors, alert rules, notification channels.
• Admin. Everything a member can do, plus credentials (environment files, database passwords, deploy-hook tokens, basic-auth, the SSH key pool, integration tokens), deletions, and team membership.
• Owner. Everything an admin can do, plus billing and transferring the team.

So a member can deploy to production but cannot read the site's .env, delete the server, or change their own role. The Roles section of Settings → Team shows the full matrix and who holds each role.

Which actions need admin

Deleting a server, a site, a managed database, or a database user, and restoring a backup over live data. Configuration you can recreate, such as a redirect, a cron entry, or an alert rule, needs only the member role.

Anything that runs as the provisore account needs admin, because provisore can use sudo: the browser terminal, server commands and recipes, editing nginx.conf, php.ini or a site's vhost, a daemon or cron entry that is server-wide and runs as provisore. A site's daemons and cron entries run as the site's own account and need only the member role.

Approving or rejecting a promotion somebody else asked for also needs admin. See Checks & promotions.

Changing roles

A role change takes effect at once, including for access tokens the member already holds. Four changes are not allowed:

• Changing your own role, in either direction.
• Changing the role of someone above you. An admin cannot demote an owner.
• Granting a role above your own. To make someone an owner, transfer ownership to them.
• Demoting the last owner. Every team needs an owner for billing and ownership transfer.

Invitations

Invite people by email from Settings → Team and choose a role. An invitation is a single-use link that expires after seven days. You can resend a pending invitation, which retires the old link, or revoke it.

• The invited person must register with the invited address and verify it. Inviting alice@example.com and signing up as alice@other.com does not work, and forwarding the link gives nobody else access.
• Every role can see the member list, so anyone working on the fleet can tell who else has access.

Belonging to several teams

One account can belong to many teams, with a different role in each. Switch between them from the team menu at the top of the sidebar. An access token belongs to the team it was created in and cannot be pointed at another one.