👥 Team management

Invite collaborators to your workspace, assign roles, and manage access from Workspace → Team.

Roles and permissions

Each user in your workspace has exactly one of three roles:

Role	What it can do
Owner (tenant_owner)	The account creator. Full access to everything an Admin can do. There is one Owner; it cannot be edited, deactivated or removed from the Team page.
Admin (tenant_admin)	Full management access: team (invite / edit / remove members), billing (plans, add-ons, cancellation), API keys, audit log, SSO, onboarding, settings and integrations.
Member (tenant_member)	Day-to-day workspace access (products, designs, orders). Can view the team list and plan quotas, but cannot manage the team, billing or API keys, and never sees the account's API secret.

When inviting or editing a user you can only assign Admin or Member — the Owner role is not assignable.

Inviting a member

From Team → + Invite a member (Owner/Admin only). Two modes are supported:

• Email invitation — provide the email (and optionally a name and role) without a password. The person receives an invitation email with a secure link, valid for 7 days and usable once. On the accept page they choose their own password (minimum 8 characters) and are signed in immediately.
• Direct creation — provide the email and an initial password (8+ characters). The account is created immediately; share the initial password with the new member and ask them to change it.

An email address can only exist once per workspace — inviting an already-registered email is rejected.

Managing and revoking access

Owners and admins can, for any Admin or Member:

• Deactivate / reactivate — a deactivated user can no longer sign in, but keeps their account and can be reactivated later. Prefer this for temporary leave.
• Remove — permanently deletes the user from the workspace.
• Edit — change name, role, or reset the password.

The Owner account is protected: these actions are not available on it. The team list shows each member's role, last login and active status.

Seat limits per plan

The number of team members (Owner + Admins + Members) is limited by your plan's team seats quota. When the quota is reached, new invitations are rejected with a "Member quota reached" error — upgrade your plan from Billing to add more seats. Current usage vs. limit is visible in your workspace quotas (see Onboarding); per-plan seat counts are on the pricing page.

Audit trail

Team actions are recorded in your account's audit log — for example team.invited (with email and role) and team.invite_accepted. See Security → Audit log.