Access Control
Access control in Tapitalee centers around team memberships. Users can belong to one or more teams, and roles are assigned per-team. This page explains how roles, permissions, and tokens work together to control access.
Team Memberships
Everything in Tapitalee is organized around teams. Users can belong to multiple teams, with each membership having its own assigned role. This allows users to have different permission levels across different teams.
Each role provides a specific set of permissions:
| Role Permissions | Read-only | Member | Admin | Owner |
|---|---|---|---|---|
| View everything | ✓ | ✓ | ✓ | ✓ |
| Deploy apps | ✓ | ✓ | ✓ | |
| Manage variables | ✓ | ✓ | ✓ | |
| Create and run tasks | ✓ | ✓ | ✓ | |
| Create releases | ✓ | ✓ | ✓ | |
| Modify apps, processes, add-ons, domains, and commands | ✓ | ✓ | ||
| Approve releases | ✓ | ✓ | ||
| Manage team memberships and access rights | ✓ | |||
| Delete team | ✓ |
Access Rights (Enterprise Plans)
On enterprise plans, lower-privileged users can be granted additional permissions via Access Rights. These can be assigned on either:
- Per-team basis: Grant additional permissions to all apps within the team
- Per-app basis: Grant additional permissions to a specific app only
This allows fine-grained control, such as allowing a read-only user to deploy a specific application without giving them deployment rights across the entire team.
API Tokens
Deploy Tokens
Deploy tokens are attached to a specific app and have limited rights to that app. They are designed for use in automated systems such as GitHub Actions or other CI/CD pipelines.
Deploy tokens provide:
- Scoped access to a single application
- Limited operations (primarily deployment)
- No personal credential exposure in automated systems
- Revocable access without affecting user accounts
Membership API Tokens
Membership API tokens are attached to a user+team combination (i.e., a team membership). These tokens allow individual users to grant CLI usage based on their team membership permissions.
Membership tokens:
- Inherit the user’s role permissions for that team
- Are specific to one user’s membership in one team
- Allow CLI operations without interactive authentication
- Can be revoked independently of other tokens