Team Access and API Keys
Expanso Cloud supports shared organization access for people and API keys for automation. Use organization roles to manage team responsibilities and key scope to limit which workspaces an integration can access.
Sign in
Cloud supports passwordless email sign-in and configured social sign-in providers. Choose one of the methods displayed on the login page. Email magic links expire; request another if the link is no longer valid.
After sign-in, select the organization and workspace you intend to operate.
Invite and manage members
In a shared organization's Settings, authorized users can invite colleagues, inspect pending invitations, change member roles, and remove members. Personal organizations do not support invitations.
The customer organization roles are owner, admin, and member:
| Permission | Owner | Admin | Member |
|---|---|---|---|
| Manage workspaces, pipelines, and templates | Yes | Yes | Yes |
| Manage bootstrap tokens | Yes | Yes | Yes |
| Create and view API-key metadata | Yes | Yes | Yes |
| Revoke own API keys | Yes | Yes | Yes |
| Revoke another member's API keys | Yes | Yes | No |
| Administer members and invitations | Yes | Yes | No |
| Update organization settings | Yes | Yes | No |
| Delete the organization | Yes | No | No |
Roles apply at the organization level. Member is not a read-only role. Organization membership should reflect who is trusted to operate its resources. The member-management UI restricts changes to owner and self roles.
Create an automation key
Open the workspace's Keys view or API Access dialog to create a key scoped to that workspace. Organization Settings also provides key creation, where you can choose one workspace or all workspaces in the organization. Give the key a name that identifies the integration and choose an expiry. A no-expiry option is available when appropriate.
Copy the raw key when it is shown and store it securely. It is shown once; subsequent key listings expose metadata rather than the raw credential. Cloud rejects expired or revoked keys and records last use.
Prefer a workspace-specific key when an integration only needs that workspace. Scope limits the workspaces a key can access; it should not be interpreted as a custom read-only role or a separate permission policy for each pipeline.
Connect the CLI
The workspace overview's API Access dialog provides the actual endpoint and CLI profile instructions. Use those instructions to configure automation, then verify that the profile reaches the intended workspace.
Follow Deploy to Cloud for the full setup. Keep keys out of checked-in YAML and shell history where possible, and use your CI system's secret handling for automated deployments.
API keys and bootstrap tokens
| Credential | Purpose | Scope |
|---|---|---|
| API key | CLI and API operations | Selected workspace or organization workspaces, according to key scope. |
| Bootstrap token | Register an edge node | The workspace that issued the token. |
Revoking an enrollment token and revoking an API key are different operations. Use the credential's own management view and check its purpose before changing it. For node onboarding, see Fleet management.
