Owner · OWNER
Manages the team, nodes, rules, and costs, and can also manage Manager and Owner roles. The primary owner is also responsible for initiating primary ownership transfers and account closure.
Colleagues sign in individually. They share team resources.
Invite colleagues to join the team with their own email addresses and collaborate as owners, administrators or users. Sign-in identities are independent, and management of resources is authorised separately from day-to-day use.
Learn about inviting to joinTheir own email address, joining the same team.
Enter a colleague's email address, choose User or Manager, and send the invitation. Your colleague signs in with the invited email address and completes email verification, then accepts the invitation if it is still valid. The invitation record retains the role, status, and expiry time, and pending invitations can be resent or revoked.
Members sign in individually, and their identity verification records belong to them as well; they do not share the team owner's results. There is no need to give every colleague the same account.
Distinct responsibilities, each with its own permissions.
Manager · MANAGER
Manages regular users, resources, traffic routing, source admission, and auditing, and also has permissions for purchases, billing, subscriptions, and payment methods. Cannot manage owners or other managers.
User · USER
Views team resources, rules, and source information, and obtains and uses client connection profiles. Resource changes and cost handling are the responsibility of managers or owners.
Sensitive operations such as role changes and primary ownership transfers require Passkey or TOTP verification within the last ten minutes. Primary ownership is used for billing and historical attribution, and only the primary owner can initiate a transfer to a team manager who has completed identity document verification; other owners have the same day-to-day management permissions.
Multiple teams, managed separately.
A single sign-in can join multiple teams, and you can switch between them in the console. Resources, orders, subscriptions, and billing are managed separately, and member rate settings apply only to the current team.
Adjust roles when people's responsibilities change, and remove members when team access is no longer needed. Device connection profiles and account identity are managed separately, and disabling a specific device is handled in the individual terminal profile.
Learn about member and terminal rate limits →Frequently asked questions.
Can managers also purchase resources and make payments?
Yes. Managers have permissions for reading billing information, purchasing resources, and managing subscriptions and payment methods. Users do not have these financial permissions.
Can an administrator change the owner or another administrator?
No. Administrators can manage regular users; managing roles requires the owner. Ownership transfers are initiated separately by the primary owner, with identity re-verification as required.
The invited email differs from my current sign-in email. Can I join directly?
No. You must switch to the invited email address and complete email verification, then accept a valid invitation. Revoked, expired or no-longer-pending invitations cannot serve as new permission to join.