Teams and roles
A team owns everything: apps, functions, databases, caches, buckets, the wallet and the keys. Each person has one role in each team.
Roles#
| Role | Read | Change | Billing | Keys and members |
|---|---|---|---|---|
owner | yes | yes | yes | all; change roles; delete the team |
admin | yes | yes | yes | revoke others' keys; invite and remove members |
developer | yes | yes | no | make and rotate keys up to developer |
billing | yes | no | yes | no |
viewer | yes | no | no | no |
No key or invite can be wider than the role making it. The buyer's and payer's ids (tax details, payments) are for owner, admin and billing only.
Personal and shared teams#
Everyone has a personal team they own. To work with others, make a shared team in the dashboard; it starts on Hobby with its own wallet. Switch the current team from the menu at the top of the dashboard.
A shared team can be deleted when it is empty (no apps, functions, databases, caches or buckets) and its wallet is at zero. Its invoices and ledger are kept.
Invites and members#
- An admin or owner invites by email, as admin, developer, billing or viewer. An invite works for 7 days, even while sign-up is closed.
- Owners are made after they join. An owner changes roles; the member's keys wider than the new role are revoked. A team always keeps one owner.
- An admin or owner removes a member, and anyone can leave; the keys that person made in this team are revoked. Nobody leaves their personal team.
API keys#
cloudhost keys create ci --role developer --expires 90
# created key 7e5926b6f29c (developer, expires …). Shown once:
# chk_live_…
cloudhost keys list
cloudhost keys rotate 7e5926b6f29c # the old key works 24 hours more
cloudhost keys revoke 7e5926b6f29cAn API key has a fixed role and covers the whole team. It is shown once; its expiry is 1–3,650 days, or none. Rotating makes a new key with the same name, role and expiry, and the old one works for 24 hours more. Revoking is immediate (up to a minute on other servers).
The audit log#
cloudhost audit --limit 50
# 2026-11-04T09:30:00.000Z key:7e5926b6f29c function.deploy my-apiEvery change in the team is recorded with who (a key, a person, a build or the platform), what and on what. In the dashboard, the CLI and the MCP tool list_audit.
Step-up for sensitive actions#
Sensitive actions from the dashboard (making keys, invites, role changes, deleting databases and caches, restores, changing the plan and the budget, …) need a second factor confirmed in the last 10 minutes: a passkey, an authenticator app, or a code on the channel you did not sign in with. API keys pass, since a key was made under step-up and is limited by its role.
A dashboard session ends after 12 hours idle and 30 days at most. See your sessions in the dashboard's settings, and end them all at once.
Passkeys. In Account settings, under Security, choose "Add a passkey"; your browser asks for your fingerprint, face or device lock, and the passkey stays on your device or in your password manager. From then on choose "Sign in with a passkey" on the sign-in page: no email or code. A passkey asks for user verification every time, so it is two factors by itself: signing in with one counts as stepped up, and it confirms sensitive actions too. Rename or remove each passkey, and see when it was added and last used. Adding or removing one needs step-up and is emailed to you.