Authorization

Every action in the Temps API is guarded by a permission check. Instance accounts, project teams, and API keys use separate role vocabularies, and project-level grants can only narrow an account's instance-wide permissions.

Role-based access control

Every action in the Temps API is guarded by a permission check. Instance accounts use the Admin or User role. API keys use a broader set of machine-oriented roles, while the Teams feature uses Owner, Admin, Deployer, and Viewer for project access. These layers are intentionally distinct.

Instance account roles

Role	What they can do
Admin	Full access — manage users and roles, projects, deployments, environments, domains, backups, and every other platform resource
User	Create and manage projects, deployments, domains, and environments; read analytics, audit logs, and backups
Instance roles set the platform-wide permission ceiling. A project team grant can remove permissions from that ceiling, but cannot add permissions the account does not already have. See Teams and Collaboration for project team roles.

Inviting team members

Create a user account

Three ways to do this

1
Go to Settings then Team in your project.
2
Click Invite Member.
3
Enter the member's email address and select their role.
4
Send the invitation.
Checkpoint: The invitee receives an email link; on first login their account is created and the role is applied.

Go to Settings → Team in your project
Enter the member's email address and select their role
They receive an invitation link; on first login their account is created and the role is applied

Or create the account directly with bunx @temps-sdk/cli users create --username alex --email alex@example.com --roles user -y. See Manage Team Access for the step-by-step guide.

Environment permissions

Permissions can be further narrowed per environment. For example, you can grant a member write access to staging but read-only access to production.

Environment-level overrides layer on top of the project role — the environment setting can only restrict, not expand, what the project role allows.

Configure environment permissions in Settings → Environments → [environment] → Access.

API key scopes

Create an API key with specific scopes

Two ways to do this

1
Go to Settings then API Keys and click Create API Key.
2
Enter a name (e.g. github-actions-deploy or monitoring-readonly).
3
Select only the permission scopes the integration needs.
4
Click Create and copy the key — it is shown only once.
Checkpoint: The key appears in Settings > API Keys and can be revoked individually without affecting other keys.

Create scoped keys in the dashboard until your installed CLI advertises custom in apikeys create --help. Older CLI releases expose legacy role labels that the current API rejects.

API keys carry explicit permission scopes chosen at creation time. A key only grants the listed permissions, regardless of the creating user's role.

Scope	What it grants
`projects:read`	View projects and their settings
`projects:create`	Create projects
`projects:write`	Modify existing projects
`deployments:read`	View deployments and build logs
`deployments:create`	Trigger new deployments
`deployments:write`	Modify deployment configuration and related settings
`deployments:delete`	Cancel, pause, and tear down deployments
`analytics:read`	View analytics data
`environments:read`	View environment configuration
`metrics:read`	View metrics data

This is not the full scope list — Temps has 100+ granular permission scopes. These are the ones used most often when creating scoped API keys.

Principle of least privilege

Create one key per integration and grant only the scopes that integration actually needs. A CI/CD pipeline that only triggers deployments needs deployments:create — not full admin access. Keys can be revoked individually from Settings → API Keys without affecting other integrations.

For creating and managing API keys, see Authentication → API Keys.