Roles and access
Understand workspace membership, billing authority and integration scopes.
Workspaces use owner, admin and member roles. Owners and admins can manage workspace settings where the product grants them access; members use the capabilities available to their account. Some billing actions, including the customer portal, are reserved for owners.
API-key and OAuth access still requires valid workspace membership. A write scope permits eligible operations; it does not bypass the workspace budget or grant owner permissions. The server checks access on execution, not just when the client first connects.
If an operation returns 403, verify the workspace, current membership, token scope and applicable entitlement. Do not fix a missing permission by sharing someone else's key. See authentication.