Team & access
Invite teammates, assign roles, and manage workspace-level settings in RouteShift — the access control surface for shared keys, budgets, and billing artifacts.
A RouteShift workspace can have any number of members. Roles control what each member can see and do.
Roles
| Role | Capabilities |
|---|---|
| Owner | Everything Admin can do, plus invitations, member role changes/removals, and workspace deletion. One owner per workspace. |
| Admin | Read and manage keys, providers, routing rules, and billing. Admins can list pending invitations, but cannot create invitations or change/remove members. |
| Member | Read-only on dashboards and request logs. Cannot mint keys, edit rules, or add providers. |
Role comparison
| Action | Owner | Admin | Member |
|---|---|---|---|
| View dashboards and logs | ✓ | ✓ | ✓ |
| Mint / edit / revoke keys | ✓ | ✓ | — |
| Add / edit providers | ✓ | ✓ | — |
| Create / edit routing rules | ✓ | ✓ | — |
| View billing and invoices | ✓ | ✓ | — |
| Invite members | ✓ | — | — |
| Change member roles | ✓ | — | — |
| Remove members | ✓ | — | — |
| Delete workspace | ✓ | — | — |
Inviting members
Only the workspace owner can create invitations. Open Settings → Team → Invite, enter the email, and choose member or admin. RouteShift returns a magic-link URL that expires in 7 days for the owner to share. Owners and admins can list pending invitations; invitation creation, role changes, and removals are owner-only operations.
Invites are tied to email — once accepted, the member signs in via the same auth flow as the owner.
Invitations are stored against a normalized (trimmed, lowercase) email and duplicate member or pending-invite requests return 409. Accepting an invitation adds the user to the team; role changes are limited to member and admin, and an owner cannot change or remove another owner.
Invitation lifecycle
Owner creates invitation
The owner enters an email and selects a role (member or admin). RouteShift generates a magic-link URL valid for 7 days.
Owner shares the link
The magic-link URL is shared out-of-band (email, Slack, etc.). RouteShift does not send the invitation email directly — the owner controls delivery.
Recipient accepts
Clicking the link creates the account (or links an existing one) and adds the member to the workspace with the specified role. The invitation is consumed and cannot be reused.
Audit trail
The invitation, acceptance, and any subsequent role changes are recorded in the workspace audit log.
Audit log
Every membership change (invited, accepted, role changed, removed) writes to the workspace audit log alongside key and routing-rule changes. Filter by type=membership to see only access events.
Single sign-on
For per-employee, short-lived API keys backed by real IdP authentication, use the SSO device flow — CLI-driven login against Google Workspace or Okta, no admin involvement.
Dashboard SSO via SAML or OIDC is on the roadmap; reach out to support@routeshift.io if you need it.