Team and roles

Invite people to your Beliq organization, assign one of five roles, and transfer ownership. Managed in the dashboard under Members.

A Beliq organization can have as many members as you need, each holding one role. Roles decide what a member can see and change: API keys and webhooks, billing, other members, or nothing beyond read access. You manage the team in the dashboard under Members, at /o/{orgSlug}/members.

Every member holds exactly one of five roles.

• Owner has full control, including transferring ownership and deleting the organization. Every organization has exactly one owner. Deleting an organization is refused while it holds a live network registration or a send that has not settled. Beliq support clears both: a live registration is retired, and a send that has stopped moving is closed out. A document the organization has received never holds the delete.
• Admin can do everything the owner can except transfer ownership and delete the organization.
• Developer works with the product itself: API keys, webhooks, and PDF templates.
• Billing manages the subscription and billing details, nothing else.
• Viewer has read-only access.

Audit log is the record of every meaningful change to the organization: keys minted and revoked, endpoints added and switched off, members invited and removed, roles changed, subscription changes. Owners and admins can read it at /o/{orgSlug}/audit. Admins hold it because they can perform nearly everything it records, and someone who can act on a suspicious entry has to be able to see it.

Owners and admins invite people by email address. Beliq sends the invitee a link to accept; if the email does not arrive, the dashboard shows a copy link you can send yourself.

• Invitations expire after 7 days. An expired link no longer works; send a fresh invitation.
• The invitee must accept from the invited email. Accepting requires signing in with an account whose email matches the invitation. A different email is rejected, and an expired or already-used link returns not-found.

Choose the invitee’s role when you send the invitation. You can change it once they have joined.

From Members, owners and admins can:

• Change another member’s role to admin, developer, billing, or viewer. Your own row has no role control.
• Remove a member from the organization.

Both take the access that role gave with them, in the same step:

• The API keys that member created are revoked when they are removed, or when their new role can no longer create keys (billing or viewer). Requests with a revoked key return INVALID_API_KEY from then on.
• Open invitations are withdrawn: the ones addressed to a removed member, so an invitation sent earlier cannot let them back in, and the ones they sent themselves once their new role can no longer invite (developer, billing, or viewer).
• A key that records no creator stays active. Keys created before this was tracked do not name the member who created them, and a key loses its creator when the account that created it is deleted. A removal or a role change cannot attribute such a key to anyone. After a removal, or a role change to billing or viewer, the dashboard says how many such keys the organization has, if any; review them under API keys and revoke by hand.

Only the owner can transfer ownership. The recipient can be any member of the organization, whatever their role. A member who already owns the most organizations one account may own cannot receive another.

Transfer is a deliberate, confirmed action: you type TRANSFER to confirm. It happens atomically, promoting the recipient to owner and demoting you to admin in the same step.

• Email notifications: which alerts reach owners and admins.
• Authentication: API keys, which developers, admins, and owners manage.