# Manage your dashboard team

Your dashboard team is the people who work in your KeenAuth account: they configure environments, look after end users and manage billing. Team members are separate from your end users and from the administrators of your customers' organizations. Open **Team** in the dashboard to see the members, the open invitations and, on Enterprise, the custom roles.

One person can belong to several KeenAuth accounts with the same sign-in. The account picker in the top bar switches between them. When the account you switch to needs a different sign-in, the dashboard asks you to sign in again for that account.

## Built-in roles

Every member holds one or more role assignments. A role assigned for the whole account applies to every project and environment of the account.

| Role | What it can do |
|---|---|
| `owner` | Everything, including closing the account, transferring ownership, creating `production` environments, deleting environments, changing the issuer mode, and plan and billing changes. |
| `admin` | Everything an owner can do except the owner-only actions above and billing. Manages the team and custom roles, but cannot invite, assign, revoke or remove an owner. |
| `developer` | Reads and writes environment configuration (applications, connections, branding, hooks and similar). Creates management API keys and management clients only in `development` and `staging` environments. Sees end-user personal data masked and cannot act on end users. |
| `support` | Reads configuration, logs and audit events, and acts on end users: blocking, ending sessions, resetting credentials, deleting users. Sees end-user personal data in full. Cannot change configuration. |
| `billing` | Sees usage, the plan and invoices, and changes the plan. Has no access to environment configuration or end users. |
| `viewer` | Reads configuration, logs, audit events and usage. Sees end-user personal data masked. |

Every role can see the team list. Security settings, signing keys, custom domains, bulk export and import, and platform support access grants are limited to `owner` and `admin`.

### Actions that need a recent sign-in

Some actions are accepted only if you signed in during the last 5 minutes. Otherwise the dashboard asks you to sign in again and then continues:

- inviting members, assigning and revoking roles, removing members
- creating, editing and deleting custom roles
- transferring ownership and closing the account
- creating `production` environments, deleting environments and changing the issuer mode
- plan and billing changes
- granting platform support access and changing dashboard security settings

## Invite a member

Only an `owner` or `admin` can invite. An `admin` cannot invite someone as `owner`.

1. Open **Team**, then choose **Invite a member**.
2. Enter the email address, the role and the scope. The `owner` role can only be given for the whole account. Project and environment scopes need the Enterprise plan; see "Custom roles and scoped assignments" below.
3. Choose **Create invitation**.

The dashboard shows the invitation link once. Copy it at that moment: it cannot be shown again. The dashboard also tells you whether an invitation email was sent to the invitee. The email is written in your dashboard language, or in English. If no email was sent, give the link to the invitee over a channel you trust.

Limits:

- An invitation expires 7 days after it is created.
- An account can create at most 50 invitations in 24 hours and can have at most 100 open invitations.
- An address can have only one open invitation in an account at a time.

To withdraw an invitation, open **Invitations** and choose **Revoke invitation**. The link stops working at once.

### Accept an invitation

The invitee opens the link and signs in to the dashboard. The invitation can only be accepted by a dashboard user whose verified primary email address is the invited address; signing in with another address does not work. After acceptance the member is active with the invited role.

An invitation carries the authority of the member who sent it. If that member is no longer an active member when the link is used, or can no longer give the invited role, the invitation no longer works. An expired, used, revoked or unknown link, and a link opened with the wrong address, all show the same message: ask the person who invited you for a new link.

## Change roles and remove members

From the member's menu in **Members**:

- **Assign role** adds an assignment. A member can hold several assignments; the same role with the same scope cannot be assigned twice.
- **Revoke** removes one assignment.
- **Remove member** removes every assignment of the member and ends their membership. The member loses access to the account at once.

An `admin` cannot revoke an owner's `owner` role or remove an owner. The last active `owner` of an account can neither be removed nor lose the `owner` role, so an account always has an owner.

When a role is revoked or a member is removed, that person's dashboard sessions and access to the account are revoked as well. See [Dashboard access security](/docs/security/dashboard-access).

## Transfer ownership

Only an `owner` can transfer ownership. The new owner must be another active member who is not already an owner and who has signed in to the dashboard with multi-factor authentication at least once.

Choose **Transfer ownership** in the member's menu and type the member ID to confirm. In one step the member becomes an `owner` and your own `owner` role becomes `admin`. Only an owner can make you an owner again.

## Custom roles and scoped assignments

Custom roles and project or environment scoped assignments are available on the Enterprise plan. On other plans the dashboard shows the **Custom roles** tab with a plan notice, and assigning a custom role or a scoped role is rejected.

### Create a custom role

`owner` and `admin` members manage custom roles under **Team** > **Custom roles**.

- **Role key**: 3 to 40 characters of lowercase letters, digits and underscores, starting with a letter. It cannot be a built-in role name and cannot be changed later.
- **Name**: 1 to 100 characters.
- **Permissions**: management API permissions that apply in the environments where the role is assigned, at most 200.
- **Dashboard actions**: account, project, environment and billing actions in the dashboard.

A role needs at least one permission or dashboard action. These limits apply:

- Owner-only actions (closing the account, transferring ownership, creating `production` environments, deleting environments, changing the issuer mode) cannot be part of a custom role.
- You can only give the permissions and actions your own role holds in a `production` environment. The dashboard offers only those.
- To edit a role you must hold everything in both its current and its new content. If a role grants more than your own role, ask an account owner to change it.
- A role that is still assigned or named by an open invitation cannot be deleted. Revoke those first. Deleting is possible even after the account has left the Enterprise plan.

Inviting members, assigning roles and managing custom roles always need the built-in `owner` or `admin` role for the whole account; a custom role does not give these team actions.

### Scoped assignments

A role can be assigned for the whole account, for one project (every environment of that project) or for one environment. The project or environment must belong to the account. A member with only scoped assignments sees only the projects and environments those assignments cover, and gets dashboard access only to those environments. When several assignments cover the same environment, the member has the permissions of all of them there.

The `owner` role cannot be scoped.

## Related pages

- [Dashboard access security](/docs/security/dashboard-access)
- [Data isolation between environments](/docs/security/tenant-isolation)