Skip to main content

Teams & Access Control

Manage who can access your organization and what they can do.

Organizations​

An organization is a workspace that groups your projects, applications, and team members. Each organization has its own:

  • Projects and applications
  • Databases and resources
  • Billing subscription (instance plan)
  • Team members and roles
  • Notification channels

Team Members​

Inviting Members​

  1. Go to Organization Settings → Team
  2. Click Invite Member
  3. Enter their email address
  4. Select a role
  5. Click Send Invite

The invited member receives an email with a link to join your organization.

Roles​

RolePermissions
OwnerFull access. Manage billing, team, and all resources. Cannot be removed.
AdminManage projects, apps, databases, and team members. Cannot manage billing.
MemberView and deploy applications. Cannot create/delete projects or manage team.

Managing Members​

  • Change role: Go to Team → click the member → select new role
  • Remove member: Go to Team → click Remove next to the member

Authentication​

Email & Password​

Standard sign-up with email verification. Password requirements:

  • Minimum 8 characters
  • Mix of letters and numbers recommended

OAuth Providers​

Sign in with third-party providers (availability depends on platform configuration):

  • GitHub
  • Google
  • GitLab

Two-Factor Authentication (2FA)​

Add an extra layer of security with TOTP-based 2FA:

  1. Go to Account Settings → Security
  2. Click Enable 2FA
  3. Scan the QR code with your authenticator app (Google Authenticator, Authy, 1Password, etc.)
  4. Enter the verification code
  5. Save your recovery codes in a secure location
caution

Store your recovery codes safely. If you lose access to your authenticator app and don't have recovery codes, you'll need to contact your platform administrator.

API Keys​

Generate API keys for programmatic access to your organization's resources.

Creating an API Key​

  1. Go to Account → API Keys
  2. Enter a name (e.g., "CI/CD Pipeline")
  3. Click Create
  4. Copy the key immediately — it is shown exactly once and cannot be retrieved again
Keys are scoped to your active organization

There is no permissions picker. A key is bound at creation time to whichever organization is active in the switcher, and it carries the access of the user who created it. To act on a different organization, switch organizations first, then create a second key.

Because a key inherits your own access, changing or removing that user's role also changes what the key can do.

Using API Keys​

Pass the key in either header — both are accepted:

curl -H "Authorization: Bearer your-api-key" \
  https://your-kuploy-instance.com/api/...
curl -H "x-api-key: your-api-key" \
  https://your-kuploy-instance.com/api/...

Managing Keys​

  • Delete: Go to Account → API Keys and click Delete next to the key. Deletion takes effect immediately and cannot be undone — any caller still using the key starts getting 401s, so roll out the replacement first.
  • Rotate periodically: create the new key, update your callers, then delete the old one.
  • Delete unused keys rather than leaving them enabled.

Best Practices​

  1. Use least privilege — Assign the minimum role needed for each team member
  2. Enable 2FA — Especially for admin and owner accounts
  3. Rotate API keys — Regularly rotate keys used in CI/CD pipelines
  4. Audit team access — Periodically review who has access and remove inactive members
  5. Use separate keys per service — Don't share a single API key across multiple systems