Members and roles
Members join a workspace through an invitation and receive roles per project. Grant the least privilege: keep members read-only when editing is not required, and scope management to one project instead of the whole workspace.
Invite members
Open “Team members → Member management”, select the project, enter the member email and sign-in method, then assign roles. The console matches an existing account by email and sign-in method: a match becomes active, no match becomes pending. Do not treat pending as access, and do not assume an invitation email was sent or that an acceptance flow exists.
Identity sources are isolated. The same email used with email and password, Google or GitHub creates different identities, and they are never merged automatically. Confirm the sign-in method the member actually uses when inviting them.
Role recommendations
The console currently provides three roles, which can be combined: Admin, Developer and Billing. Exact permissions follow the role descriptions shown in the interface. Recommended use:
| Role | Recommended for | Typical duties |
|---|---|---|
| Admin | Project leads, platform administrators | Managing projects, members, keys, budgets and policies |
| Developer | Application and operations engineers | Using project resources and reading the debugging detail they need |
| Billing | Finance or cost owners | Reviewing usage, costs and budgets without touching technical configuration |
Do not make every member an Admin for convenience. Budget, routing and key management for production projects should stay with a small number of people.
Member lifecycle
When a member joins:
- Join only the projects currently needed.
- Select the least-privileged role.
- Do not share other members' personal keys.
- Issue a team key for each application that must call the API.
When a member changes role or leaves:
- Identify the team keys they own or created.
- Hand over and rotate the service credentials.
- Revoke project memberships that are no longer needed.
- Remove the member last.
- Check usage records for unusual calls around the departure time.
Periodic review
Review members, roles and project scope at least every quarter. Review high-risk projects more often, focusing on invitations left pending for a long time, admins with no recent activity, temporary members, and access to finished projects.