# Roles and console access

> Understand console roles while keeping public API authorization project-scoped.

Canonical guide: <https://api.blackpearl.com/docs/rbac>

Raw Markdown: <https://api.blackpearl.com/docs/raw/rbac.md>

OpenAPI: <https://api.blackpearl.com/v1/openapi.json>

Console users belong to an organization as `owner`, `admin`, `member`, `viewer`, or `billing`. Owners and administrators manage projects, keys, members, capabilities, and limits; members operate enabled capabilities; viewers are read-only; billing users focus on billing data.

The console authenticates with an HTTP-only session cookie. Public `/v1` integrations do not use that cookie or inherit a user's console session: they use a project-scoped Bearer key as described in [Authentication](https://api.blackpearl.com/docs/authentication).

Organization invitations are deliberate and role-specific. Do not share personal credentials or API keys to work around missing membership. Administrators should issue the appropriate membership and create separate project keys for deployed services.