TempsTemps
On this page
  1. Understand roles
  2. Create a user account
  3. Assign a role
  4. Create an API key
  5. Scope API key permissions
  6. Deployment tokens

Manage Team Access

Temps has three related permission layers: instance account roles, project team roles, and API-key roles/scopes. Keeping those vocabularies separate ensures each teammate and integration receives only the access it needs.

Understand roles

Instance account roles

Human accounts use these platform-wide roles:

RoleDescription
AdminFull access to everything — projects, deployments, settings, users, backups, and system configuration
UserCan create and manage projects, deploy, and view most resources. Cannot delete critical resources or manage system settings.

Project team roles

When the Teams feature is enabled, project access uses Owner, Admin, Deployer, and Viewer. A project role narrows the account's instance-wide permissions; it never expands them. See Teams and Collaboration.

API-key roles

API keys can use the predefined Admin, PlatformAdmin, User, Reader, and ApiReader roles, or Custom with explicit permission scopes. MetricsIngest is reserved for infrastructure metrics ingestion.

RoleDescription
ApiReaderRead-only API access. For monitoring and reporting integrations.
PlatformAdminPlatform and user administration; read-only for projects and deployments, but able to manage domains, environments, backups, and other platform resources.
MetricsIngestSystem role used for metrics-ingestion API keys and integrations.

users create --roles <role> and apikeys create --role <role> validate directly against the roles listed above — no dashboard detour needed. Use --roles user or --roles admin for instance accounts, and any of admin, platform_admin, user, reader, api_reader, custom, or metrics_ingest for API keys.

Create a user account

Create a user account

  1. 1

    In the sidebar, click Settings.

  2. 2

    Go to the Users section and click Add User.

  3. 3

    Enter the user's email and name.

  4. 4

    Set a temporary password (the user should change it on first login).

  5. 5

    Select a role and save.

    Checkpoint: The new user appears in Settings > Users and can log in at your Temps instance URL with the provided credentials.

  1. In the sidebar, click Settings
  2. Go to the Users section
  3. Click Add User
  4. Enter the user's email and name
  5. Set a temporary password (the user should change it on first login)
  6. Select a role

The new user can now log in at your Temps instance URL with the provided credentials.

Or create the account directly with bunx @temps-sdk/cli users create --username jordan --email jordan@example.com --roles user -y.

The first user account is created during temps setup (or the first visit to the dashboard). This account always has the Admin role and cannot be downgraded.

Assign a role

Assign a role

  1. 1

    Go to Settings > Users and find the user.

  2. 2

    Click Edit (or the actions menu).

  3. 3

    Select the new role and save.

  4. 4

    Role changes take effect immediately on the user's next API call or page load.

    Checkpoint: Confirm the user's Roles column in Settings > Users reflects the new role; active sessions are not terminated.

To change a user's role:

  1. Go to Settings > Users
  2. Find the user
  3. Click Edit (or the actions menu)
  4. Select the new role
  5. Save

Role changes take effect immediately. The user's next API call or page load uses the new permissions. Active sessions are not terminated — the user does not need to log in again.

Permission examples by role

ActionAdminUser
View projects and deploymentsYesYes
Create and deploy projectsYesYes
Manage environment variablesYesYes
View logs and analyticsYesYes
Manage domainsYesYes
Delete projectsYesNo
Manage users and rolesYesNo
Configure backupsYesYes
System settingsYesNo

Create an API key

Create an API key

  1. 1

    Go to Settings > API Keys and click Create API Key.

  2. 2

    Enter a name (e.g. github-actions-deploy or monitoring-readonly).

  3. 3

    Select the permissions to grant.

  4. 4

    Click Create.

  5. 5

    Copy the key immediately and store it securely.

    Checkpoint: The key is shown only once; use it in the Authorization: Bearer header for API calls.

API keys are used for programmatic access — CI/CD pipelines, scripts, monitoring integrations, and MCP servers.

  1. Go to Settings > API Keys
  2. Click Create API Key
  3. Enter a name (e.g. github-actions-deploy, monitoring-readonly)
  4. Select the permissions to grant (see below)
  5. Click Create
  6. Copy the key immediately — it is shown only once

The API key is used in the Authorization header:

curl -H "Authorization: Bearer tk_your_api_key" \
  "https://your-temps-instance/api/projects"

Scope API key permissions

Create a scoped CI/CD key

  1. 1

    Go to Settings > API Keys and click Create API Key.

  2. 2

    Name the key for its integration (e.g. ci-deploy or monitoring-readonly).

  3. 3

    Grant only the permissions the integration needs (for CI/CD: deployments:create, deployments:read, projects:read, environments:read).

  4. 4

    Click Create and copy the key, creating a separate key per integration.

    Checkpoint: Confirm the key's permissions match the intended scope so a compromised key can be revoked without affecting other systems.

API keys use the Custom role by default, meaning they have no permissions until you explicitly grant them. This follows the principle of least privilege.

Common permission scopes:

CI/CD deployment key

Grant only what is needed to trigger deployments:

  • deployments:create — trigger new deployments
  • deployments:read — check deployment status
  • projects:read — list projects
  • environments:read — list environments

Read-only monitoring key

For dashboards and reporting tools:

  • projects:read
  • deployments:read
  • environments:read
  • analytics:read
  • metrics:read

Full management key

For administrative scripts (use sparingly):

  • All permissions — equivalent to Admin role

Security best practice: Create separate API keys for each integration. If a key is compromised, you can revoke it without affecting other systems. Name keys descriptively so you know which integration each key belongs to.

Deployment tokens

In addition to API keys, Temps automatically generates a deployment token for each project environment. This token is injected as the TEMPS_API_TOKEN environment variable in your application container.

Deployment tokens allow your running application to call back into the Temps API — for example, to report analytics events or upload source maps.

These tokens are:

  • Auto-generated and managed by Temps
  • Scoped to the specific project and environment
  • Rotated on each deployment
  • Not visible in the API key management UI (they are managed per-environment)

You do not need to create or manage deployment tokens manually. They are available in your application as process.env.TEMPS_API_TOKEN.

Was this page helpful?