Teams and roles
Who on a team can do what.
A team owns its hosting projects and databases. Everyone on it has one of four roles:
| Role | In short |
|---|---|
| Viewer | Read-only |
| Developer | Deploy and manage env vars for preview and custom environments, never production |
| Member | Everything a developer can, plus production, domains, project setup, SQL, and migrations |
| Owner | Everything, including project settings, deleting, and members |
Roles are enforced by the API, so the dashboard, the CLI, the Management API, and AI agents all get the same answer. An access token acts with its creator's current role: changing someone's role changes what their tokens can do right away.
Permissions
✓ means the role can. "Non-production" is preview deployments, preview branches, and custom environments. An env var for All Environments counts as production, since production builds with it too.
Hosting
| Action | Viewer | Developer | Member | Owner |
|---|---|---|---|---|
| See projects, deployments, logs, env var names | ✓ | ✓ | ✓ | ✓ |
| Create a project, connect or sync its repo | ✓ | ✓ | ||
| Change the production branch and build settings | ✓ | |||
| Delete a project or a deployment | ✓ | |||
| Deploy, redeploy, cancel: non-production | ✓ | ✓ | ✓ | |
| Deploy, redeploy, cancel: production | ✓ | ✓ | ||
| Promote or roll back within a custom environment | ✓ | ✓ | ✓ | |
| Promote or roll back production | ✓ | ✓ | ||
| Set env vars: preview, a branch, a custom environment | ✓ | ✓ | ✓ | |
| Set env vars: production, All Environments | ✓ | ✓ | ||
| Read env var values: non-production | ✓ | ✓ | ✓ | |
| Read env var values: production | ✓ | ✓ | ||
| Create or delete custom environments | ✓ | ✓ | ||
| Rename an environment or change its branch | ✓ | ✓ | ✓ | |
| Change an environment's database | ✓ | ✓ | ||
| Add, route, or remove domains | ✓ | ✓ | ||
| Link a database to a project | ✓ | ✓ | ||
| Manage app cron jobs | ✓ | ✓ |
Databases
| Action | Viewer | Developer | Member | Owner |
|---|---|---|---|---|
| See databases, tables, schema, logs | ✓ | ✓ | ✓ | ✓ |
| Run SQL, apply migrations, edit tables and storage | ✓ | ✓ | ||
| Read the service key, credentials, vault values, backups | ✓ | ✓ | ||
| Create a database | ✓ | ✓ | ||
| Restore a backup, change auth settings | ✓ | |||
| Delete a database | ✓ |
Team
| Action | Viewer | Developer | Member | Owner |
|---|---|---|---|---|
| Create access tokens (they act with your role) | ✓ | ✓ | ✓ | ✓ |
| Invite and remove members, change roles | ✓ |
Manage roles
In the dashboard, open Team Settings → Team Members to invite people or change a role. Invitations, role changes, and removals show in the team's activity, along with env var changes, deployments, promotions, and rollbacks.
A developer's preview and custom environment builds still receive the project's linked database and any All Environments variables. Give those environments their own DATABASE_URL or database if developers shouldn't reach production data.