Teams and roles

Every project, deployment, domain, API key and invoice belongs to exactly one team. A team is created for you on first sign-in, and every request you make is answered in the context of one team.

Teams are the isolation boundary. Data belonging to one team is not visible to another, at the database, at the API and in stored files.

The four roles

Role	For
Owner	The person who answers for the bill. One per team
Admin	Runs the team day to day: members, domains, API keys, forms
Member	Ships. Creates projects, deploys, promotes, sets variables
Viewer	Reads. Sees projects, deployments, domains and the plan, changes nothing

Roles are cumulative: an Admin can do everything a Member can, and so on down.

A Viewer does not see everything. Form submissions, outside notification addresses, build logs and function runs need Member, because they carry visitor personal data or can echo secrets a build printed. Invoices need Admin. A Viewer sees who is on the team and their roles, but not other members’ email addresses, including the ones a form notifies or the one that pushed a deployment. When a build fails, a Viewer sees why and how to fix it, but not the quoted line from the build output. In the dashboard, a Viewer sees a short note in place of those panels.

Two things are worth knowing before you assign one. Member is the working role, and it deliberately stops short of destruction: a Member can deploy and promote all day and cannot delete a project or a deployment. And API keys always act as Member, whoever created them, so no key can delete a project, touch a domain or read invoices. A key can read submissions and logs. An AI agent signed in as a person gets that person’s role, capped at Member the same way.

What each role can do

	Owner	Admin	Member	Viewer
Projects
View projects and deployments	●	●	●	●
Create and update projects	●	●	●
Delete a project	●	●
Deployments
Trigger, cancel, upload	●	●	●
Promote to production (roll back)	●	●	●
Delete a preview	●	●	●
See who can open previews	●	●	●
Change who can open previews, set the preview password	●	●
Delete a deployment	●	●
View build logs and function runs	●	●	●
Domains
View domains and DNS status	●	●	●	●
Add, verify, remove, manage DNS	●	●
Environment variables
View keys	●	●	●	●
Set and delete	●	●	●
Share links
Create and revoke	●	●	●
Forms
View forms and their settings	●	●	●	●
View submissions and external recipients	●	●	●
Mark spam, trash, export	●	●	●
Create a form, manage external recipients	●	●
Erase submissions by email (GDPR)	●	●
API keys
List	●	●	●
Create, rotate and revoke	●	●
Members
View member names and roles	●	●	●	●
View member email addresses	●	●	●
Invite, revoke invitations, remove members	●	●
Change a member’s role	●
Transfer ownership	●
Billing
View plan and usage	●	●	●	●
View invoices	●	●
Change plan, cancel, open the billing portal	●
Team
Update notification preferences	●	●	●
Change the team notification email	●	●
Delete the team	●

The line runs between reversible and not. A Member can deploy, promote and delete a preview, all of which can be redone. Deleting a deployment removes a rollback target and deleting a project removes everything, so both stay with an admin.

Invitations

An owner or admin invites by email and picks the role:

1. The invitation is sent, with a link to app.deploybase.eu/join/{token}
2. The invitee signs in or creates an account, and accepts
3. They join with the role they were invited as

Invitations expire after 7 days. They can be resent up to three times in 24 hours, and revoked at any point before they are accepted. Expired invitations are cleaned up a week after expiry; accepted ones are kept as a record of who joined when.

Only owners and admins can see the pending invitation list.

Transferring ownership

A team has exactly one owner, always. The owner can hand the role to any other member, which promotes them and demotes the previous owner to admin in one step.

An owner cannot leave the team without transferring first. That is the only way to avoid a team with a bill and nobody who can pay it.

Managing your team

Dashboard: People and access → Members. Over the API: /api/v1/team/members and /api/v1/team/invitations. Over MCP: list_team_members and list_team_invitations.