Support
Every resource you create belongs to an account, not to an individual. An account can be shared with teammates: the creator is the owner, and everyone else joins as a member. Organizations group teams for larger collaboration and enterprise SSO.
Members and invitations
Manage your team from Account → Members (/account/members). Click Invite member, enter their email and the role to grant, and they receive an invitation link. Pending invitations appear under Account → Invitations (/account/invitations), where the owner can revoke any that have not yet been accepted. There is exactly one owner, and ownership can be transferred to another member.
Named-role RBAC
Permissions are assigned through named roles managed under Account → Roles (/account/roles). A role is a matrix of permissions over resources such as Endpoints, Domains, Certificates, Dedicated IPs, Firewall, Rate Limits, Traffic Inspector, Members, Roles, Account Settings, and Billing. Roles are enforced server-side on every action — a member without a permission gets a 403 even if they reach the API directly.
Seat cap
The number of members an account may hold is capped by your plan’s max-members setting, shown as seat usage on the Members page. A plan with the cap unset (or 0) means unlimited members. Non-owner members require the account_members entitlement; the owner always has access regardless of plan.
Organizations
Organizations live under Organizations (/account/organizations) and require an enterprise/team plan. Create one from /account/organization/create (only name and slug are required); the creator becomes the org owner, and a new organization starts with a default member cap of 50. Org roles are Owner, Admin, and Member. Organizations carry quotas for Endpoints, Tunnels, Members, and Bandwidth, each reporting a utilization percentage.