An organization owns your apps, billing, and everyone who works on them. This page covers membership, roles, API keys, and the audit log, all under Settings.
Inviting members
- Go to Settings > Team and select Invite Member.
- Enter the email address and pick a role.
- Select Send Invite.
The invitee receives an email with an accept link and appears under Pending Invitations until they accept. Invitations expire after 7 days, and Revoke cancels one.
An invitation can only be accepted by someone signed in with the invited email address. Accepting re-checks your plan's member limit, so an invitation issued before the organization filled up can still be refused at that point.
Pending invitations reserve member slots: an organization at its member limit cannot send more invitations. Invitations are rate limited to 20 per hour per client IP address — like every limit on the platform, the counter is keyed by IP, not by user or organization.
Roles and permissions
There are exactly four roles: owner, admin, developer, and viewer. Owner is not assignable — an organization has exactly one, set when it is created and moved only by transferring ownership. Invitations and role changes can set admin, developer, or viewer.
| Capability | Owner | Admin | Developer | Viewer |
|---|---|---|---|---|
| View apps, channels, bundles, deployments, devices | Yes | Yes | Yes | Yes |
| View settings | Yes | Yes | Yes | Yes |
| Create, update, delete apps | Yes | Yes | No | No |
| Create, update, delete channels | Yes | Yes | No | No |
| Upload bundles | Yes | Yes | Yes | No |
| Delete bundles | Yes | Yes | No | No |
| Create deployments | Yes | Yes | Yes | No |
| Roll back deployments | Yes | Yes | No | No |
| Invite, remove, and re-role members | Yes | Yes | No | No |
| Change organization settings | Yes | Yes | No | No |
| Create and revoke API keys | Yes | Yes | No | No |
| View billing | Yes | Yes | No | No |
| Manage billing | Yes | No | No | No |
| Read the audit log | Yes | Yes | No | No |
| Transfer ownership, delete the organization | Yes | No | No | No |
Cloud build permissions exist in the same model (view for everyone, trigger for developers and above, cancel for admins and above), but cloud builds are not yet available.
Changing a role
On Settings > Team, the Role column is a dropdown on every row except the owner's and your own. Changing it takes effect immediately and is written to the audit log.
Removing a member
The remove icon appears on every row except the owner's and your own. The owner cannot be removed.
Transferring ownership
An organization always has exactly one owner. To hand it over, the owner opens Settings > Team, uses the ⋮ menu on the target member's row, and selects Transfer ownership.
The target member is promoted to owner and the previous owner is demoted to admin in a single transaction, so the organization is never seen with two owners or none. The new owner is emailed, and both role changes are written to the audit log. Only the owner can do this, and undoing it requires the new owner to transfer it back.
Ownership carries the billing relationship, so transferring is also the prerequisite for an owner who wants to leave or delete their account.
Leaving an organization
Any member except the sole owner can leave from Settings > Team with Leave Organization. Leaving removes your membership and revokes every API key you created for that organization. Rejoining requires a new invitation.
An owner who tries to leave is refused and pointed at ownership transfer. If you are the last owner and want the organization gone, delete the organization instead — see Dashboard overview.
API keys
API keys authenticate the CLI and CI/CD pipelines. Manage them under Settings > API Keys. Listing keys needs the same permission as creating them, so the page only loads for owners and admins.
Creating a key
Select Create API Key and provide:
| Field | Required | Notes |
|---|---|---|
| Key Name | Yes | A label to recognise the key by |
| Scopes | No | Checkboxes grouped by resource. Leave all unchecked to grant full access |
| Expires in (days) | No | Leave empty for a key that never expires |
The key is shown once, in a banner with a copy button, immediately after creation. It is stored only as a one-way hash, so there is no way to see it again — if you lose it, revoke it and create another. Keys start with the prefix dya_.
The scope list is the same permission set as the role model above. A scoped key is limited to the permissions you select; an unscoped key carries full access.
Reviewing and revoking
The table shows each key's name, prefix, scopes, creation date, last-used time, and expiry. Revoke disables a key immediately, and anything using it loses access.
For how keys are sent with requests, see Authentication and access control.
Audit log
Settings > Audit Log records significant actions in the organization. Audit events are recorded on every plan, but reading and exporting the log requires the Scale plan or higher. On a lower plan, the events are still being captured and become visible when you upgrade.
Recorded actions include organization changes and ownership transfers, member invitations, joins, removals, departures and role changes, app creation, updates and deletion, signing key uploads, channel creation, updates and deletion, bundle uploads and deletions, deployments and rollbacks, API key creation and revocation, new subscriptions and applied coupons, and account deletions and personal-data exports by members of the organization.
Each entry shows the action, the user who performed it, the affected resource type and ID, the source IP address, and a timestamp. Selecting a row expands it to show the event's metadata as JSON.
The log can be filtered by action type, date range, and user, and Export CSV downloads up to 10,000 matching entries. The Action Type dropdown lists every action name the platform records, grouped by resource (app.created, member.invited, billing.subscription_created, and so on), and matches an entry's action exactly. The User dropdown is built from the users appearing in the entries currently loaded.