Managing team access and API keys
The admin playbook for who can do what: inviting people with the least access they need, environment limits, minting and rotating API keys, and audits.
Access is the part of an admin’s job nobody notices until it goes wrong. This playbook covers people (invites and roles) and machines (API keys), and how to check what happened afterwards. For the model behind it, see Team and roles.
Give the least access that works
Access has three dials:
| Dial | Options |
|---|---|
| Workspace role | Member (access only to the apps you pick) or Workspace admin (admin on every app) |
| App role, per application | admin, developer, finance, viewer |
| Environment access | All, all non-production, production only, or a chosen list |
Workspace admin is almost always more than someone needs. A contractor building your storefront wants developer on one app with all non-production environments — they can build and test without ever seeing a live order.
Invite someone
Open Workspace → Team and click Invite team member. Enter their email, choose the workspace role (only owners can make workspace admins), set environment access, tick each application and its role, then Send invite.
Invites expire after 7 days. The person must accept while signed in with exactly the address you invited — a different account, even their own, is refused. You’re emailed when they accept.
App admins can invite people into their own apps but can’t grant admin.
Change or remove access
- Invites tab: Resend issues a fresh link and restarts the 7 days (the old link dies); Revoke cancels it.
- Members tab → Edit access changes roles and environments; Remove from workspace removes someone immediately. They can be invited again later. The owner can’t be removed.
Do this the day someone leaves, not at the next review.
Mint an API key
Keys are made for the environment selected in the top bar — there’s no environment choice in the dialog, so switch first.
Open Developers → API keys → Create API key:
- Secret (
sk_) keys are for servers. Choose Scoped (least privilege) and tick only the scopes the integration uses; Full access is for your own backend at most. - Publishable (
pk_) keys are safe in a browser and can only do a handful of narrow things — see API keys.
The key is shown once. Copy it into your secrets manager before closing the dialog.
Rotate and revoke
- Rotate issues a new key and keeps the old one working for an overlap window (24 hours by default, up to 7 days), so you can deploy the new one without downtime.
- Revoke kills a key immediately. Use it when a key may have leaked — then mint a replacement.
Connected AI assistants
Assistants such as Claude that were connected with a sign-in appear under View connected apps on the API keys page, with what each can read. Revoke cuts them off immediately — the next request from that assistant is refused.
Check what happened
App → App Settings → Audit log lists the last 100 administrative, team, and billing actions for the selected environment — who did what, and when. Owners and workspace admins can see entries.