Skip to main content

Teams & Access Control

Manage who can access your organization and what they can do.

Organizations​

An organization is a workspace that groups your projects, applications, and team members. Each organization has its own:

  • Projects and applications
  • Databases and resources
  • Billing subscription (instance plan)
  • Team members and roles
  • Notification channels

Team Members​

Inviting Members​

  1. Go to Organization Settings → Team
  2. Click Invite Member
  3. Enter their email address
  4. Select a role
  5. Click Send Invite

The invited member receives an email with a link to join your organization. The invitation stays pending until they accept it, and it expires after 48 hours.

Pending invitations are listed under Invitations. From a row's actions menu you can:

  • Copy Invitation — copy the link and share it yourself, for example if the email landed in spam.
  • Resend Email — send the same invitation again. The link and expiry don't change.
  • Cancel Invitation — revoke it, so the link stops working.

Accepting an Invitation​

The link opens a page that only accepts the invitation for the email address it was sent to:

  • Already have an account with that email? Sign in, and you come back to the invitation to accept it.
  • No account yet? Create one on that page. The email is filled in and locked. Verify your address from the email we send, and the verification link brings you back to accept.
  • Signed in with a different email? Sign out first, then open the link again.

A link that says the invitation is invalid has expired, was cancelled, or was already used. Ask for a new one.

Roles​

RolePermissions
OwnerFull access. Manage billing, team, and all resources. Cannot be removed.
AdminManage projects, apps, databases, and team members. Cannot manage billing.
MemberView and deploy applications. Cannot create/delete projects or manage team.

Managing Members​

  • Change role: Go to Settings → Users → click the member → select new role
  • Remove member: Go to Settings → Users → click Remove next to the member
  • Limit a member to specific projects: Go to Settings → Users → Add Permissions on the member → tick projects under Projects

Authentication​

Email & Password​

Standard sign-up with email verification. Password requirements:

  • Minimum 8 characters
  • Mix of letters and numbers recommended

OAuth Providers​

Sign in with third-party providers (availability depends on platform configuration):

  • GitHub
  • Google
  • GitLab

Two-Factor Authentication (2FA)​

Add an extra layer of security with TOTP-based 2FA:

  1. Go to Account Settings → Security
  2. Click Enable 2FA
  3. Scan the QR code with your authenticator app (Google Authenticator, Authy, 1Password, etc.)
  4. Enter the verification code
  5. Save your recovery codes in a secure location
caution

Store your recovery codes safely. If you lose access to your authenticator app and don't have recovery codes, you'll need to contact your platform administrator.

API Keys​

Generate API keys for programmatic access to your organization's resources.

Creating an API Key​

  1. Go to Account → API Keys
  2. Enter a name (e.g., "CI/CD Pipeline")
  3. Click Create
  4. Copy the key immediately — it is shown exactly once and cannot be retrieved again
Keys are scoped to your active organization

There is no permissions picker. A key is bound at creation time to whichever organization is active in the switcher, and it carries the access of the user who created it. To act on a different organization, switch organizations first, then create a second key.

Because a key inherits your own access, changing or removing that user's role also changes what the key can do.

Using API Keys​

Pass the key in either header — both are accepted:

curl -H "Authorization: Bearer your-api-key" \
  https://your-kuploy-instance.com/api/...
curl -H "x-api-key: your-api-key" \
  https://your-kuploy-instance.com/api/...

Managing Keys​

  • Delete: Go to Account → API Keys and click Delete next to the key. Deletion takes effect immediately and cannot be undone — any caller still using the key starts getting 401s, so roll out the replacement first.
  • Rotate periodically: create the new key, update your callers, then delete the old one.
  • Delete unused keys rather than leaving them enabled.

Best Practices​

  1. Use least privilege — Assign the minimum role needed for each team member
  2. Enable 2FA — Especially for admin and owner accounts
  3. Rotate API keys — Regularly rotate keys used in CI/CD pipelines
  4. Audit team access — Periodically review who has access and remove inactive members
  5. Use separate keys per service — Don't share a single API key across multiple systems