Memberships
Team memberships control who can access your team and what they can do. Each user belongs to a team through a membership, which has an assigned role.
Roles
Teams have four roles, from lowest to highest privilege:
- Read-only: View-only access to team resources
- Member: Standard team member access for day-to-day operations
- Admin: Full operational control over apps and infrastructure
- Owner: Complete team control including membership management
Role Permissions
| Permission | Read-only | Member | Admin | Owner |
|---|---|---|---|---|
| View apps, add-ons, processes, deployments, and logs | ✓ | ✓ | ✓ | ✓ |
| Deploy apps | ✓ | ✓ | ✓ | |
| Manage variables | ✓ | ✓ | ✓ | |
| Create and run tasks | ✓ | ✓ | ✓ | |
| Create releases | ✓ | ✓ | ✓ | |
| Modify apps, processes, add-ons, domains, and commands | ✓ | ✓ | ||
| Approve releases | ✓ | ✓ | ||
| Manage team memberships and access rights | ✓ | |||
| Delete team and manage VPCs | ✓ |
Access Rights
Access rights allow you to grant specific permissions to lower-privileged roles on a per-app basis. This is useful when you want to give a member or read-only user additional capabilities for specific apps without promoting their entire role.
Available Access Rights
| Access Right | Description |
|---|---|
| View Secrets | View secret variable values (normally hidden from read-only users) |
| Modify App | Modify app settings, processes, healthchecks, domains, and variables |
| Console Access | Access interactive console sessions for the app via Web or CLI |
| Modify Commands | Create, edit, and delete scheduled commands |
| Launch Tasks | Launch background tasks (non-console) |
| Modify Add-ons | Create, edit, and delete add-ons |
| Deploy | Deploy applications and create deployments |
| Approve | Approve releases for deployment |
How Access Rights Work
- Access rights are configured per membership
- Each access right can be scoped to a specific app or granted for all apps
- Access rights override role restrictions for the specific permissions they grant
- Multiple access rights can be combined for fine-grained control
Managing Memberships
Via Web Interface
- Navigate to Team Settings → Members
- Click Invite Member to add new users
- Click on a member to edit their role or access rights