Teams, members & roles

Every Koo account is a shared workspace. A member is a user with a role in the account, and every action — viewing logs, deploying, changing billing — is gated by that role. You manage members through the accounts API; each entry is a member object.

Roles

Each member holds exactly one of four roles. Roles are cumulative: every role can do everything the roles below it can.

Role	What it can do
`owner`	Everything, including billing, plan changes, and member management. Exactly one per account, held by the account's creator until transferred.
`admin`	Full operational control: create and delete apps and environments, and change the account's handle and profile. The highest role below owner.
`editor`	Edit services, deploy and roll back, and manage domains and environment variables & secrets.
`reader`	View apps, services, deployments, logs, metrics, and status.

An account always has exactly one owner. You can't demote or remove the current owner directly — transfer ownership to another member first, then change or remove the old owner like any other member.

Manage members

Any member can list an account's members. Changing roles and removing members requires the owner role.

Change a role

Set the member's new role on their membership. The change takes effect on the member's next request — there's no re-invite or re-login step.

Transfer ownership

To hand over the account, assign the owner role to another member. The transfer is atomic: that member becomes the owner and the previous owner becomes an admin in the same operation, so the account never has zero or two owners.

Remove a member

Removing a member revokes their access to the account immediately. It doesn't delete their Koo account or their other memberships — they just lose access to this one.

Invite a member Coming soon

Invitations will work by link, not by direct add — joining an account always requires the invitee's consent.

The owner will generate a one-time invite link scoped to a role: reader, editor, or admin. An invite can never grant owner — that role only moves by transfer.
The owner shares the link out-of-band (chat, email — anywhere).
The invitee signs in to Koo and accepts. The link works once, then expires.

Accepting will be refused if the account is already at its plan's seat limit; the owner will need to add seats or upgrade first. Until invitations ship, there is no way to add a member to an existing account.

Seats & plans

Each plan includes a number of member seats, and members beyond the included count add a per-seat charge to your subscription. See Billing for the seat counts and per-seat pricing on each plan.

Service accounts are different Coming soon

A service account will be a non-human principal for CI and automation: it will belong to one account, hold a role of its own — reader, editor, or admin, never owner — and authenticate with kc_… tokens — see API tokens.