Organizations

An organization is the boundary for members, API keys, usage, and credits. Keep production access in one organization and invite people with the smallest role they need.

Roles

admin

Settings, members, invitations, SSO, domain verification, billing, API keys, and organization deletion.

member

Dashboard, playground, usage, and support tickets. Members cannot manage keys, billing, or membership.

Invite a teammate

Admins open Settings, enter the email, and choose admin or member. The invite must be accepted by that same address.

Keys stay with the organization

API keys are not tied to a person. Store them in a secret manager. When someone leaves, remove the member, then revoke keys they could have copied. See Authentication.

SSO and domain

Admins can verify a domain and configure SSO from Settings. Those buttons open the WorkOS Admin Portal (Okta, Azure AD, Google, or generic SAML/OIDC). Switching into an SSO organization may require signing in again.

When someone leaves

Remove the member, then rotate keys. Removing membership stops dashboard access. Key rotation covers credentials already sitting in a laptop or a deploy.