An organization lets several people work under one Tokens account: shared keys and usage reporting, a role for each person, and a monthly spending cap for each member. This page covers creating a team, inviting people, what each role can do, spending caps, switching between organizations and removing a member.
Teams may not be enabled for your account
Teams are a feature that Tokens switches on per deployment. When it is off, the Team & members item is missing from the dashboard sidebar and the organization switcher is hidden. If you open /dashboard/team anyway, it says "Teams and collaborative workspaces are coming soon." Ask support if you need it.
Personal and team organizations#
Every account has a Personal organization, created automatically. Your keys, plan and wallet live there until you create a team. A personal organization has no members to invite: Invite Member is only shown in team organizations.
A Team organization is one you create. You become its owner. Everything below happens in the organization that is active in the switcher, so check the name and the Team or Personal tag in the top bar before you create a key or invite someone.
Create a team#
- Open the organization switcher in the dashboard top bar.
- Press Create Team Organization.
- Enter the Team / Organization Name and press Create Team.
The dashboard reloads with the new team active and you as its owner. Open /dashboard/team to manage it. Owners and admins can also open Org Settings there to change the Organization Name, Billing Email (Receipts), Company / Legal Name and BIN / VAT / Tax ID.
Invite members#
Invitations are links. Tokens does not email them for you.
- In the team organization, open /dashboard/team and press Invite Member.
- Enter the Email Address, choose a Role and optionally a Monthly Spend Cap (Optional USD).
- Press Generate Invitation.
- Copy the Invitation Link (valid for 7 days) and send it to the person yourself.
The invited person opens the link while signed in to a Tokens account that uses the same email address, and presses Accept and join organization. A link issued to one address does not work for another one: the error says which address the invitation was issued to. After joining, they open the organization switcher and choose the team to start working in it.
Things that can stop an invitation:
- Seat limit. The number of members comes from the plan active on the organization. Without a plan, the limit is 1, which is the owner. Past the limit, you get "Organization has reached its plan seat limit of N members. Upgrade your plan to invite more team members." Pending invitations count towards the limit until they are accepted or expire.
- Already a member. "This user is already a member of the organization".
- Expired or used link. Generate a new invitation.
Tip
Set the member's spending cap in the members table after they have joined, and check that it shows there. See the section on per-member spending caps below.
Roles and what each can do#
There are five roles. The first four can be chosen when you invite someone or change a role; the owner is the person who created the team.
| Action | Owner | Admin | Billing | Developer | Viewer |
|---|---|---|---|---|---|
| See the member list | Yes | Yes | Yes | Yes | Yes |
| See the usage table for all members | Yes | Yes | Yes | Own row only | Yes |
| Create API keys | Yes | Yes | No | Yes | No |
| See keys in the organization | All | All | None | Own keys | None |
| Rotate or revoke keys | Any | Any | No | Own keys | No |
| Invite members, change roles, set caps | Yes | Yes | No | No | No |
| Remove members | Yes | Yes | No | No | No |
| Edit Org Settings | Yes | Yes | No | No | No |
The invitation form describes the roles like this:
- Developer: "Create & manage own keys, view own usage".
- Admin: "Manage members, keys, view all usage".
- Billing: "Manage subscription & top-ups, invoices".
- Viewer: "View org usage & models, read-only".
Limits on admins:
- An admin cannot change another admin's role, and cannot remove another admin.
- An admin cannot set a spending cap for themselves or for the owner.
- Nobody can demote or remove the owner from the dashboard. The role list for a member has Admin, Billing, Developer and Viewer only.
Billing and viewer members cannot create keys and see no keys, so they cannot run requests in the team. In the playground they see "No active API keys found" for the team.
Per-member spending caps#
A cap limits how much one member's requests can spend in a calendar month. Set it in the Monthly Spend Cap column of the members table (in dollars), or leave it blank for no cap. The table saves when you leave the field.
How it is enforced:
- Tokens adds up what that member has spent in the team since the start of the month, plus requests still running, plus the most the new request could cost. If the total would pass the cap, the request is refused before it reaches the model.
- The refusal is
402 member_cap_reached. The message tells the member to ask the organization administrator to raise the limit. It is listed in Errors. - The cap is per person, not per key. Individual keys can also have their own monthly cap; both are checked. See API keys.
- A cap of 0 is treated as no cap. Use a small positive number to block a member.
The Usage by Member (Current Month) table on the same page shows each member's requests, total tokens, month spend in USD and cap.
Switch between organizations#
Use the organization switcher in the top bar. It lists every organization you belong to, with a check mark on the active one. Choosing another one reloads the dashboard. Keys you create, usage you see and the team page all follow the active organization.
You can belong to several teams at once and keep your Personal organization as well.
What is shared and what is not#
Per organization, shared by its members:
- API keys. A key belongs to the organization it was created in. Which keys you can see depends on your role (see the table above).
- Usage records. Every request is recorded against the organization and the member who made it. The usage-by-member table on the team page reads from them.
- Funding. Requests made with a team key are charged against the wallet and plan of the organization the key belongs to. The invitation page says members issue keys "funded by the organization's credit pool".
Not shared:
- Your Personal organization. Its keys, plan and wallet stay yours and are not visible to the team.
- Your profile, email and sign-in. Teammates see your name and email in the member list and nothing else.
- Referral earnings. They are paid to your own wallet. See Referrals.
Check the funding before you roll out
The seat limit and the team's funding come from the plan and wallet attached to the team organization, not from your personal ones. Before inviting a whole team, make a test request with a team key and check that it is charged as you expect, or ask support how your team is funded.
Remove a member#
Owners and admins can press Remove on a member row. A confirmation dialog titled "Remove Team Member" warns: "All API keys created by this member will be permanently revoked immediately." Press Confirm & Revoke Keys to continue.
When you remove someone:
- Every active key they created in this organization is revoked at once. Tools using those keys get
401 invalid_api_keyon the next request. - They lose access to the team's keys, usage and settings.
- Their own account and Personal organization are untouched. If the removed team was their active organization, they are moved back to their Personal one.
If you want to keep a key a member made, create a new key yourself first and move your tools to it. Revoked keys cannot be restored.