Team and access

Invite people to your account, choose the role each one holds, transfer ownership, and give scripts and pipelines credentials of their own.

Your team is the people who can sign in to the console of your account. Each of them has their own sign-in and their own place in the audit trail, so every change is recorded under the name of whoever made it and nobody shares a password. You manage the team from Team.

Each member holds one account role. The role decides what they can see and change in the console and through the Admin API. It has nothing to do with the users of your realms, whose roles you define separately.

Account roles

There are four roles, and each one includes everything the role before it can do:

Role	What it adds
Auditor	Reads every screen, the audit trail, the plan and its usage. Changes nothing and never sees a secret.
Developer	Creates and changes realms, clients, users, roles and scopes. Cannot read, create or rotate secrets — a client’s secret and a webhook’s signing secret included — and has no say over billing.
Admin	Credentials, such as API secrets, client secrets and webhook signing secrets, and the team: invites people, changes their roles and removes them.
Owner	The plan, the invoices, the payment method and the balance, and handing the account to someone else. Exactly one member is the owner.

Can	Auditor	Developer	Admin	Owner
Read realms, clients, users, roles, scopes and the audit trail	Yes	Yes	Yes	Yes
See the plan and its usage	Yes	Yes	Yes	Yes
Change realms, clients, users, roles and scopes	—	Yes	Yes	Yes
Read, create and rotate secrets	—	—	Yes	Yes
Invite, change and remove members	—	—	Yes	Yes
See invoices, the payment method and the balance	—	—	—	Yes
Change the plan and open the billing portal	—	—	—	Yes
Transfer ownership	—	—	—	Yes

Behind each role is a set of permissions written as resource:method, such as client:update or secret:read. The console asks for exactly the permissions the API enforces, so a control you cannot use is shown disabled with the reason instead of failing when you press it.

Narrowing a member’s role or removing them ends their console sessions at once, because their permissions are written into the tokens they already hold. Widening a role signs nobody out.

Invite someone

Send the invitation
As an owner or admin, open Team, choose Invite somebody, and enter the person’s email address and the access they get: Auditor, Developer or Admin.
The person accepts
They receive an email with a link to the invitation, which shows your account’s name, the role and how long it stays open. They sign in with the invited address, or create an account with it, and confirm with the Join button.
They sign in to the console
From then on they sign in with their own credentials and hold the role you chose.

An invitation lasts seven days and can be withdrawn while it is open.
Only the invited address can accept it, so a forwarded link lets nobody else in.
The role is fixed by whoever invites; the person accepting cannot change it. Owner is never offered: the only way to make someone the owner is to transfer ownership.
A person belongs to one Authio account at most. Inviting someone who is already active in another account is refused.

Seats

Every member and every open invitation holds a seat. When your plan sets a Team seats quota, the two together cannot go past it, and the Team screen shows the seats in use against the ceiling. Inviting with no seat free is refused with SeatLimitExceeded: withdraw an invitation, remove a member or move to a larger plan to free one.

Change a role or remove a member

Owners and admins change a member’s role, or remove them, from the Team screen. Nobody can change or remove the owner, and nobody becomes the owner through a change of role.

Removing a member ends their access at once but keeps their history: their past changes stay attributed to them in the audit trail, and inviting them again later brings back the same member.

Transfer ownership

The owner can hand the account, and its billing with it, to another member.

Make sure the new owner is on the team
They must be an active member who has already accepted their invitation.
Start the transfer
On Team, choose Transfer ownership and pick the new owner.
Confirm
Type the account’s name to confirm. The new owner takes over the plan and billing at once.

You cannot undo a transfer yourself. You stay on the team as an Admin, with access to everything except billing, and only the new owner can hand the account back.

Credentials for scripts and pipelines

People sign in; automation should not borrow their passwords. Owners and admins issue credentials for it under API Secrets:

API keys authenticate calls to the Admin API on their own, sent in the x-api-key header. A key can do only what the roles and scopes you grant it allow.
Personal access tokens belong to the person who issued them and never do more than that person may do.
Every credential — API key, client secret or personal access token — acts for the person who issued it and never does more than they may do today: its roles are narrowed to that person’s role on the team, a role you write or a credential you issue cannot carry a permission you do not hold, and when that person leaves the team their credentials stop working at once.

List realms with an API keyBash

curl https://authio.api.hyperio.tech/api/v1/admin/realms \
  -H 'x-api-key: YOUR_API_KEY'

A secret’s value is shown once, when it is created or replaced; afterwards only its last four characters are. Give each secret an expiry date and only the access it needs. Every use, accepted or refused, is recorded in the access log. The credentials of a consumer belong to its client and are not accepted by the Admin API. The Admin API reference covers authentication in detail.

Authio operators

Authio’s own staff run the platform with a reserved role that no customer account holds or can be granted. That role is what shows the Administration section of the console — plans, scheduled jobs, feature flags and dedicated environments — which never appears for a customer.

On the Dedicated plan

Members of an account on the Dedicated plan hold the same four roles on the shared console, narrowed to what applies there: the account and its environment, the subscription, their own profile and security, and the audit trail. Realms, clients, roles, scopes and secrets live in the environment and are administered from its own console. See Dedicated environment.

Next steps

Plans and billingSeats, quotas, the subscription and what happens when it lapses.Admin APIAutomate Authio with API keys.Audit and insightsSee who changed what, and when.Console tourWhat each role sees in the console.