Team Roles & Permissions
Teams use a full RBAC (role-based access control) system. Every team member is assigned a role, and each role grants a specific set of permissions that control what the member can do within the team.
Default roles
Every new team is created with three roles:
| Role | Type | Permissions | Description |
|---|---|---|---|
| Owner | System (cannot be deleted) | All 20 | Full team access. Assigned to the team creator. |
| Admin | Default | 17 | Manage extensions and team members. Cannot edit team settings, manage payouts, or remove members. |
| Member | Default | 7 | Edit extensions, create/upload versions, and view analytics; no submission, deletion, or tester/access management. |
Permission reference
There are 20 permissions across 7 categories:
Extensions
| Permission | Key | Owner | Admin | Member |
|---|---|---|---|---|
| Create extensions | team-extensions:create | Yes | Yes | Yes |
| Edit extensions | team-extensions:edit | Yes | Yes | Yes |
| Delete extensions | team-extensions:delete | Yes | Yes | -- |
| Publish extensions | team-extensions:publish | Yes | Yes | -- |
| View analytics | team-extensions:analytics | Yes | Yes | Yes |
Versions
| Permission | Key | Owner | Admin | Member |
|---|---|---|---|---|
| Create versions | team-versions:create | Yes | Yes | Yes |
| Edit versions | team-versions:edit | Yes | Yes | -- |
Secrets
| Permission | Key | Owner | Admin | Member |
|---|---|---|---|---|
| Read secrets | team-secrets:read | Yes | Yes | Yes |
| Edit secrets | team-secrets:edit | Yes | Yes | -- |
Testers
| Permission | Key | Owner | Admin | Member |
|---|---|---|---|---|
| Read testers | team-testers:read | Yes | Yes | -- |
| Invite testers | team-testers:invite | Yes | Yes | -- |
| Remove testers | team-testers:remove | Yes | Yes | -- |
Members
| Permission | Key | Owner | Admin | Member |
|---|---|---|---|---|
| Read member list | team-members:read | Yes | Yes | Yes |
| Invite members | team-members:invite | Yes | Yes | -- |
| Edit member roles | team-members:edit | Yes | Yes | -- |
| Remove members | team-members:remove | Yes | -- | -- |
Settings
| Permission | Key | Owner | Admin | Member |
|---|---|---|---|---|
| Read settings | team-settings:read | Yes | Yes | Yes |
| Edit settings | team-settings:edit | Yes | -- | -- |
Payouts
| Permission | Key | Owner | Admin | Member |
|---|---|---|---|---|
| Read payout info | team-payouts:read | Yes | Yes | -- |
| Edit payout config | team-payouts:edit | Yes | -- | -- |
team-versions:edit, team-settings:read, and team-payouts:read/team-payouts:edit are catalogue grants; there is currently no extension API action that checks them. Assigning one alone does not enable a version-edit or payout operation.
Creating custom roles
In addition to the three default roles, team owners and members with team-settings:edit permission can create custom roles:
- Navigate to Dashboard > Extensions > Teams > {team} > Roles
- Click Create Role
- Enter a name and optional description
- Choose a color for the role badge
- Select the permissions to grant
- Save the role
Custom roles appear in the role list and can be assigned to team members via the members page or when creating invite links.
Editing a custom role
Click a custom role from the roles list to edit its name, description, color, or permissions. Changes take effect immediately for all members assigned to that role.
Deleting a custom role
Custom roles (where is_system is false) can be deleted. Members assigned to a deleted role are reassigned to the default Member role. The system Owner role cannot be deleted or modified.
Permission enforcement
Permissions are enforced at the API level. Both the GraphQL and REST APIs check team permissions before executing any team-scoped operation. If a member lacks the required permission, the request is rejected with an authorization error.
For team-owned extensions, the action checks below run after the ownership check. A caller outside the team gets a not-found response. A team member missing a grant gets 403 Missing team permission: <permission> from REST or FORBIDDEN with the same message from GraphQL. Role changes apply on the next request. Solo extensions have no team-role requirement, and a team-bound developer API key can act only on its own team's extensions.
| Permission | Extension action |
|---|---|
team-extensions:edit | Update metadata; upload an icon or screenshot; delete a screenshot |
team-extensions:delete | Delete a draft extension or request deletion |
team-extensions:publish | Submit a version for review |
team-extensions:analytics | View analytics |
team-versions:create | Create or upload a version |
team-testers:invite | Invite a tester, grant private access, or create an access invite |
team-testers:remove | Remove a tester, revoke private access, or delete an access invite |
team-testers:read | List testers, private access grants, or access invites |
The default Member role includes editing and version creation, but none of the publish, delete, or tester permissions in this table. Owners and Admins hold those permissions; a custom role can grant them selectively.
The dashboard UI also respects permissions -- buttons and menu items for actions the current user cannot perform are hidden or disabled.
Next steps
- Teams Overview -- team creation and management
- Security & API Keys -- manage API keys and 2FA