Teams & roles

Roles

Every member of a team has one of three roles:

owner

Exactly one per team — whoever created it, until they transfer it. Can do everything, including deleting the team and changing other members' roles.

admin

Runs the team day to day: deletes and suspends resources, manages members, API keys and billing.

member

Builds and ships: creates projects, services and databases, deploys, and edits settings and environment variables. The default role for an invite.

What each role can do

Only an owner can remove another owner, and a team can't be deleted while it still has services, databases or other resources in it.

Invite someone

1. Open the team settings

   In the dashboard, go to Settings → Team. You need to be an admin or the owner.

2. Enter their email and a role

   Under Invite Member, enter the address and pick Member or Admin. You can't invite someone straight in as owner — transfer ownership instead.

3. They accept

   If the address already has a HostStack account, they're added to the team straight away. Otherwise they get an email with an Accept invitation link; they create an account with that same address and join. The link expires after 7 days.

Pending invitations are listed under the form, where an admin can cancel them. An invitation can only be accepted by an account with the address it was sent to, so a forwarded link is useless to anyone else.

Narrow what a member can do

By default a member can do everything in the member column above. To restrict one, select them in the members table on Settings → Team. The Permissions for … grid lets you tick read, write, delete and deploy per area, or apply a quick preset:

Once a member has any permission set, they can do only what's ticked. The grants govern changes to projects, services (including their deploys and environment variables), databases, billing and the team; everything else keeps plain member access. Permissions don't apply to admins or the owner, who can always do everything their role allows.

Transfer ownership

The owner can hand the team to an existing member from the Transfer Ownership card on Settings → Team. The new owner is promoted, the previous owner becomes an admin, and both get an email. Invite the person first if they aren't a member yet.

Transfer is how you leave a team you own: the last owner can't be removed or downgraded.

API key permissions

API keys belong to a team, not to a person, and only work on that team. Admins and the owner create them under Settings → API keys, and each key gets one of two permission levels:

full_access

Everything an admin can do. Owner-only actions — transferring ownership, deleting the team, changing roles — stay out of reach of every key.

deploy_only

Everything a member can do, except the actions that need full access: writing or revealing environment variables, creating or revoking API keys, managing members, and billing. It can still create projects, services and databases, change service settings and deploy. Use it for CI jobs that only need to trigger deploys.

Creating a key

• The key starts with hs_live_ and is shown once. HostStack stores only a hash, so copy it when it's created; a lost key has to be replaced.
• Optionally restrict it to IPv4 addresses or CIDR ranges (up to 50), and give it an expiry of 1 to 3,650 days. Without an expiry it lasts until it's revoked.
• The name and IP allow-list can be changed later. The permission level can't — create a new key and revoke the old one.
• Creating a key requires a verified email address.

Next steps

• BillingHow pricing, the free allowance and invoices work.
• CLIUse an API key from a terminal or a CI job.
• Environment variablesSecrets, and who can read and change them.