Roles and keys · Ephemeral docs

Everything in Ephemeral belongs to an organization. People join an organization with a role, and software uses organization API keys with a role of their own. The two kinds of role are separate.

People

Role	Can
Owner	Everything an admin can, plus change roles, remove admins and transfer ownership. Each organization has one owner.
Admin	Everything a member can, plus manage connections, members, invitations, API keys, billing and deployment licenses.
Member	Start, read and cancel runs; manage files and workflows; use connections by name.

Whoever creates an organization becomes its owner. Admins can invite people as admins or members and remove members. Only the owner can remove an admin or change someone's role. The owner cannot be removed; to step down, transfer ownership to an existing member, who becomes the owner while you become an admin.

API keys

An API key acts for its organization. Each key has the role member or admin, chosen when you create it. The key's secret is shown once; store it on your server and revoke the key if it leaks. Revocation takes effect immediately.

Use a member key for application code that starts runs. This is the default.
Use an admin key only for trusted setup tools that also need to create or change connections.

Both roles cover the whole organization. A member key is not read-only, and no key can be limited to particular workflows or files. If you need that separation, use separate organizations.

What each role can do

Action	Member user or key	Admin key	Owner or admin user
Start, read and cancel runs	Yes	Yes	Yes
Upload, rename and delete files	Yes	Yes	Yes
Save and delete workflows	Yes	Yes	Yes
List available connections and use them by name	Yes	Yes	Yes
Read and change connection settings, start OAuth	No	Yes	Yes
Manage members, invitations, API keys, billing and licenses	No	No	Yes

Admin keys cannot manage the organization

On the hosted service, members, invitations, API keys, credits and deployment licenses can only be managed by a signed-in owner or admin. An admin API key is refused for these actions, so a leaked key cannot buy credits, add people or issue new keys.

Hosted and self-hosted keys

	Hosted service	Self-hosted installation
Key prefix	`eak_`	`eph_`
Created in	The dashboard under API keys, or the organization API	The dashboard under Keys, or `POST /v1/keys`
Who can create keys	Owner or admin, signed in	An admin key
First key	Created by you after signing up	Issued by the bootstrap request during setup

A self-hosted installation has no customer accounts, so its admin keys also manage the installation's keys. See self-hosting for the first key and organizations for the hosted key endpoints.

In the hosted dashboard you sign in as a person and act with your membership role. Browser requests choose the organization with the X-Ephemeral-Organization header; API keys already belong to one organization.