Roles and console access

Understand console roles while keeping public API authorization project-scoped.

Console users belong to an organization as owner, admin, member, viewer, or billing. Owners and administrators manage projects, keys, members, capabilities, and limits; members operate enabled capabilities; viewers are read-only; billing users focus on billing data.

The console authenticates with an HTTP-only session cookie. Public /v1 integrations do not use that cookie or inherit a user's console session: they use a project-scoped Bearer key as described in Authentication.

Organization invitations are deliberate and role-specific. Do not share personal credentials or API keys to work around missing membership. Administrators should issue the appropriate membership and create separate project keys for deployed services.