Everyone on your account has their own login and one role. The role decides what they can see and change on every site in the account. Give each person the smallest role that lets them do their job. You can change it later.
The roles
| Role | What they can do |
|---|---|
| Owner | Everything, including deleting the account. |
| Administrator | Manages every site and the team. No billing, cannot delete the account. |
| Billing contact | Sees every site, manages invoices, the card and the plan. |
| Developer | Deploys, changes settings and backups on every site. No team or billing. |
| Viewer | Read-only access to every site. |
Who can do what
The table below is generated from the same rules the portal enforces, so it is always current.
| Can… | Owner | Administrator | Billing contact | Developer | Viewer |
|---|---|---|---|---|---|
| See every site, its settings, logs, deploys and backups | Yes | Yes | Yes | Yes | Yes |
| DNS records, nameservers and registrar settings | Yes | Yes | — | Yes | — |
| Invite and remove members, change roles, require two-factor sign-in | Yes | Yes | — | — | — |
| Invoices, the card on file, plan changes and cancelling | Yes | — | Yes | — | — |
| Create the warehouse and databases in it | Yes | Yes | — | Yes | — |
| Create and run scheduled jobs | Yes | Yes | — | Yes | — |
| Connect or disconnect Git hosts and pick repositories | Yes | Yes | — | Yes | — |
| Accept the Terms, DPA and AUP; request a countersigned DPA | Yes | Yes | — | — | — |
| Unlock a domain and reveal its transfer code | Yes | — | — | — | — |
| Delete the account or transfer its ownership | Yes | — | — | — | — |
Change someone's role
Owners and Administrators can change roles.
- Open Settings → Team.
- Find the person under Members and pick their new role.
- The change applies straight away. Their next page load uses the new role.
You can hand out Administrator, Billing contact, Developer or Viewer. Owner is not on the list; see below.
Hand over ownership
An account has exactly one Owner. Only the Owner can give ownership to someone else, and that person must already be a member.
- Open Settings → Team.
- In the member's row menu, choose Make owner….
- Enter your password and confirm Transfer ownership. The new owner must have confirmed their email address first.
Caution: you become an Administrator, and only the new Owner can give ownership back. The Owner can delete the account and move its domains away, so hand it only to someone you would trust with both.
Require two-factor sign-in for everyone
Owners and Administrators can make two-factor sign-in compulsory for the whole account with Require two-factor for all members on the Team page. You must have set up two-factor yourself first, because the rule applies to you too. Members without it are sent to their security page until they set it up. New accounts start with this switched on.
Related
- Invite a team member
- Scopes and permissions for tokens and assistants: what an API token or AI assistant may do is limited by the role of the person who connected it, and changes with it.
- Security at veldhost