Teams, members & roles

Every Koo account is a shared workspace. A member is a user with a role in the account, and every action — viewing logs, deploying, changing billing — is gated by that role.

You manage members on your account's Members page. The same operations are available through the accounts API; each entry is a member object.

Roles

Each member holds exactly one of four roles. Roles are cumulative: every role can do everything the roles below it can. The API uses the names in the first column; the console labels them Viewer, Developer, Admin, and Owner.

Role	Console label	What it adds
`reader`	Viewer	Views everything: projects, environments, services, deployments, logs, metrics, and variables. A reader may also reveal a sensitive value — every reveal is recorded in the audit log.
`editor`	Developer	Edits services, deploys and rolls back, manages custom domains and variables, opens a service's console, reveals a database's connection details, and promotes environments.
`admin`	Admin	Creates and deletes projects and environments, clones environments, publishes apps, creates API tokens, and changes the account's profile.
`owner`	Owner	Manages members and invitations, transfers ownership, and manages the plan and billing. Exactly one per account.

An account always has exactly one owner. You can't demote or remove the current owner directly — transfer ownership to another member first, then change or remove the old owner like any other member.

Manage members

Any member can see the member list. Changing roles and removing members requires the owner role.

Change a role

Pick the new role on the member's row. The change takes effect on the member's next request — there is no re-invite or re-login step.

Transfer ownership

To hand over the account, assign the owner role to another member. The transfer is atomic: that member becomes the owner and the previous owner becomes an admin in the same operation, so the account never has zero or two owners.

Remove a member

Removing a member revokes their access to the account immediately. It doesn't delete their Koo user or their other memberships — they just lose access to this one.

Invite a member

Joining works by link, never by direct add — becoming a member always takes the invitee's consent. Creating invites requires the owner role.

Open your account's Members page and click Invite member.
Choose the role the invite grants: reader, editor, or admin. An invite can never grant owner — that role only moves by transfer.
Enter the invitee's email. It is recorded so you can tell your pending invites apart — Koo doesn't send the invite itself; the link is what you share.
Click Create link and copy the link. It is shown this once and can't be retrieved later.
Share the link anywhere — chat, email. The invitee signs in to Koo, reviews the invite, and clicks Accept invitation.

Each link admits a single member, then it's spent. A link also expires on its own after seven days, and you can revoke a pending one from the Members page at any time. There is no resend: a dead link — used, revoked, or expired — is replaced by creating a new one.

Accepting is refused when the account has no seats left. The invite stays valid: once the owner has added seats or upgraded, the same link works.

Seats & plans

On the Free plan the account is fixed at one member — you can't invite anyone. Paid plans include a number of seats, and members beyond the included count add a per-seat charge to your subscription. See billing for the seat counts and per-seat prices on each plan.

Service accounts

A service account is a non-human principal for CI and automation. It belongs to one account and holds a role of its own — Read (the reader role) or Write (the editor role), never owner — so it can act, but never touch members, plans, or billing.

Service accounts don't sign in: each one authenticates with a kc_… token, created on your account's Tokens page. See API tokens for creating and revoking them.