# Members and roles

import { Steps } from '@astrojs/starlight/components';

An EkLine organization has three roles: **Owner**, **Admin** and **Member**. You manage members, roles and access under **Settings** > **Organization**.

## Roles

| Role | Who has it |
| --- | --- |
| **Owner** | The person who created the organization, until they transfer ownership to someone else. |
| **Admin** | Anyone an Owner or Admin invites or promotes to Admin. |
| **Member** | The role an invite starts with, and the role of anyone who joins through your claimed email domain. |

## What each role can do

You can act only on people whose role is lower than yours. Nobody can change their own role or remove themselves.

| Action | Owner | Admin | Member |
| --- | --- | --- | --- |
| Invite members | Yes, as Admin or Member | Yes, as Admin or Member | No |
| Delete a pending invite | Yes | Yes | No |
| Change a member's role | For Admins and Members | For Members | No |
| Remove a member | Admins and Members | Members | No |
| Transfer ownership | Yes | No | No |
| Claim or remove email domains | Yes | Yes | No |

## Invite members

<Steps>

1. Go to **Settings** > **Organization** > **Members** and click **Invite Members**. Only Owners and Admins see this button.

2. Enter an email address and select a role. The role starts as **Member**.

3. To invite more people at once, click **Add another one** and fill in the new row.

4. Click **Send Invites**.

</Steps>

Each person gets an email with a link. The invite is listed under **Pending Invites** until they open the link, sign in or sign up, and click **Accept invite**.

Invites expire after 7 days. To cancel an invite, click **Delete Invite** (the × on its row) under **Pending Invites** and confirm. To send someone a new invite, delete their pending one first, then invite the same email address again.

## Let teammates join by email domain

When the first person from your company signs up with a company email address, EkLine offers to claim that domain for the organization. Anyone who later signs up with an address at that domain sees **Your company already uses EkLine!** and can join your organization or click **Create my own organization**. People who join this way are Members.

To claim a domain later, an Owner or Admin opens **Settings** > **Organization** > **Domains**, enters it in **Domain** and clicks **Claim**. A domain can be claimed only when:

- it is not a public email domain, such as gmail.com;
- it matches your own email address;
- your email address is verified;
- no other organization has claimed it.

## Change a role, transfer ownership or remove someone

Each row in the members list has an actions menu (⋮). It is available only on rows whose role is lower than yours.

| To | Select | Then |
| --- | --- | --- |
| Change a role | **Change Role** | Select the new role in **Update Member's Role** and click **Update Role**. |
| Transfer ownership (Owner only) | **Transfer Ownership** | Confirm with **Transfer Ownership**. You become an Admin. |
| Remove someone | **Remove** | Confirm with **Remove User from Organization**. |

When you remove someone, any personal API keys they created stop working in your organization.

To leave an organization, ask someone with a higher role than yours to remove you. An Owner transfers ownership first.

Rows can carry these badges next to the role:

- **You**: your own row.
- **Joined from a shared report**: the person joined through a shared report link.
- **Unknown user**: the account no longer exists. The only action offered is **Remove**.

## The Access tab

**Settings** > **Organization** > **Access** shows your organization's EkLine token. Click the token to copy it.

- Use it in the `EK_TOKEN` field when you set up the Docs Reviewer, for example in the GitHub Action. See [Check your docs in CI](/reviewer/quickstart/).
- The token belongs to the organization, so anything done with it is recorded as the organization, not as a person.
- For your own work in Claude, Cursor or ChatGPT, create a personal API key under **Settings** > **Profile** > **Personal API keys** instead. See [MCP clients](/agent/mcp/).

Store the token as a secret in your CI system, as the Docs Reviewer quickstarts show, rather than in a file in your repository.

## Next

- [Credits and usage](/workspace/credits-and-usage/)
- [Security and data](/workspace/security-and-data/)