# Members and permissions

Invite colleagues from [Project members](/portal/members). Choose their email address and role, then send an invitation. Invitations are emailed and expire after seven days.

The recipient opens the email link, signs in with the same **verified email address**, and selects **Accept invitation**. The project then appears in their workspace switcher. A link can only be accepted once.

## Permissions

| Action | Owner | Administrator | Editor | Viewer |
| --- | --- | --- | --- | --- |
| View assets, reports, folders, events, and members | Yes | Yes | Yes | Yes |
| Read private files | Yes | Yes | Yes | Yes |
| Create signed sharing URLs | Yes | Yes | Yes | No |
| Upload, edit, moderate, move, and delete assets | Yes | Yes | Yes | No |
| Create and edit folders; mark shared events read | Yes | Yes | Yes | No |
| Create and edit lenses | Yes | Yes | Yes | No |
| Edit project settings, API keys, and connectors | Yes | Yes | No | No |
| Invite, change, and remove editors or viewers | Yes | Yes | No | No |
| Invite, change, and remove administrators | Yes | No | No | No |
| View billing usage and manage the owner's subscription | Yes | No | No | No |
| Leave the project | No | Yes | Yes | Yes |

The project creator remains its owner. Ownership cannot be transferred or assigned through an invitation. Account-level resources such as saved moderation policies and subscriptions remain personal to their account; inviting someone does not share the owner's other projects or account settings.

## Folder-scoped access

Users, invitations and API keys use the same permission editor. Choose **Custom**, choose a folder under **Scope**, and select the actions that identity may perform. **Include subfolders** controls inheritance. Add another scope to grant access to multiple folders; choose **Entire project** only when access should cover every folder and unfiled assets.

For a read-only folder, select **View assets**, **Download assets**, and **Browse folders**. Leave upload, edit, delete and share unchecked. Custom permissions replace the global preset; they do not add to an implicit Viewer or Editor role. An empty grant list gives no asset access.

A key is also limited by its creator’s current user permissions. Revoking the key or removing its creator blocks subsequent requests, including cached private downloads and queued batches. Existing signed URLs and public files remain accessible as described below.

Asset moves require edit permission in both folders. Moving a whole folder requires project administration because it changes inherited access for its subtree. Project-wide event feeds and live updates are available only to identities with project-wide asset read access; API keys use the polling feed. Scoped users can still browse and refresh their permitted assets.

## Manage invitations

Owners and administrators can see pending invitations in project settings. **Resend invitation** replaces the previous link; wait at least one minute between sends. **Revoke invitation** immediately invalidates its link. Only the owner can manage invitations for administrators.

## Change or revoke access

Change a member's role using the selector beside their email. Remove their access with **Remove member**. Members can use **Leave project** to remove their own membership. Removing or demoting an administrator also revokes their outstanding invitations.

Access is enforced by the backend, including private CDN requests. Removing a member blocks their requests and disconnects live project updates. API keys created by a collaborator follow that collaborator's current project permissions. Removing the creator makes those keys unusable for the project; promoting or re-inviting them can restore access, so revoke keys permanently when retiring an integration.

Previously issued signed URLs are bearer links and remain valid until their expiry. Public files remain public. Choose short signed-link lifetimes for sensitive content.

## Billing and limits

Uploads, storage, and delivery belong to the project owner's account. A collaborator's personal subscription does not increase the project's limits. When the owner has exhausted the upload allowance, new uploads are rejected and both the uploader and owner receive an email reminder. Each distinct recipient receives at most one reminder every 24 hours across their projects.

Email failures do not change the upload-limit response. An invitation whose email cannot be sent is invalidated and can be retried.

Site-wide maintenance and preview waitlist gates still apply; a project invitation does not bypass them.