Operating / Team and access
Team and access
Users, roles, invitations and join codes.
Roles
| Role | |
|---|---|
| Owner | One per account. Everything an admin can do |
| Admin | Everything: servers, apps, deploys, keys, tokens, the shell, billing and cancellation |
| Member | Can see most pages, but not change things |
Owner is not something you hand out. There is one, invitations never offer it, and there is no way to transfer it.
A person’s page lets an admin switch someone between member and admin. An admin cannot change the owner.
Some things are admin-only regardless. The shell is the clearest: it is a root terminal on the machine with the account’s key behind it.
Inviting one person
Users → Invite. An email address and the role they should get. They get a link, they set a password, they are in with that role.
Invitations expire after 14 days and stop working once used. Following the link twice is a person double-clicking, not a second membership.
Join codes
Account → Join code is the other way in: one link anyone holding it may use, with a usage limit you set.
Useful for onboarding a team at once. Less useful for a company you want to be careful about, because a link in a chat history is a link. The code can be reset at any time, which invalidates the old one, and the usage count is shown.
Removing someone
Removing a user deactivates the membership rather than deleting the history. Their deployments still say who made them. If they come back – re-invited later – the inactive membership is revived rather than duplicated.
Identities and accounts
Signing in is against an identity, which is a person: an email address and a password. An identity can be a user in several accounts and switches between them without signing out.
Authentication is KamalCloud’s own: a password, cookie sessions, and emailed reset tokens. There is no SSO.
Password resets
Forgot password emails a token. It expires. Setting a new password with it signs the person out of every session they had and sends them to sign in again. Nothing else in the account changes.
Cancelling the account
An admin can cancel the account. Once it is cancelled, nobody in it can open it: signing in lands on the account picker instead. KamalCloud does not offer a way to reactivate it yourself.