Teams & Collaboration
Temps has unlimited users with no per-seat fees. Group users into teams and grant each team Owner, Admin, Deployer or Viewer on specific projects; the Admin and User instance roles set the ceiling for what any member can do.
Adding team members
Temps has no email invitations. Adding someone is two steps: an instance Admin creates their account, then adds that account to a team.
- Create the user under Settings → Users → Add User, with a temporary password. See Create a user account. Users who sign in through OIDC SSO get an account on first login instead.
- Add them to a team under Settings → Teams → [team] → Add member, and choose their role in the team.
Add a team member
- 1
Go to Settings, then Teams, and open the team.
- 2
Click Add member.
- 3
Pick an existing user and a team role, then confirm.
Checkpoint: The user appears in the team's member list with the role you chose.
The user must already exist; teams members add accepts a user ID or email.
Roles
| Role | Description |
|---|---|
| Owner | Everything Admin can do, plus delete the project |
| Admin | Full operational control of the project (settings, domains, backups, crons, deployment tokens) except deleting it |
| Deployer | Deploy, create and edit environments and environment variables, run pipelines; read everything else |
| Viewer | Read-only access to the project, its deployments and logs |
Team creation and membership management require the instance-wide Admin role, independent of the team or project role a member holds.
These are the roles a member can hold within a team, and the roles a team can hold on a project. The full permission matrix, the instance-role ceiling and API-key roles are in Authorization. The four roles are fixed; custom roles are part of Temps Premium.
Project-level access
Grant a team access to a project
- 1
Open the project and go to Settings, then Access.
- 2
Click Grant access.
- 3
Select a team and the role that team holds on this project, then save.
Checkpoint: Confirm the team and role are listed on the project Access page.
Project access in Temps is granted to teams, not individual users. Grant a team a role on a specific project:
- Go to Project → Settings → Access
- Click Grant access
- Select a team (not a user) and the role that team holds on this project
A member's effective permission on a project is the intersection of their role within the team and the role that team holds on the project — there is no per-user project-role override. A project with no team grants stays open to every account; after the first grant, only members of granted teams (and instance Admins) can reach it. Grants cover every environment in the project.
Removing members
Remove a team member
- 1
Go to Settings, then Teams, and open the team.
- 2
Find the member and click Remove.
- 3
Confirm the removal.
Checkpoint: The user no longer appears in the team's member list.
Removing someone from a team takes away the project access that team gave them. Their account, and any projects they deployed, stay in place.
To delete the account itself, use Settings → Users or bunx @temps-sdk/cli users remove --id <user-id>. That removes the user from the instance, not just from one team.
Audit log
Team changes are recorded in the audit log as TEAM_MEMBER_ADDED, TEAM_MEMBER_ROLE_UPDATED, TEAM_MEMBER_REMOVED, PROJECT_ACCESS_GRANTED and PROJECT_ACCESS_REVOKED events. See Audit logging for every event type, retention, and how to filter the log.
SSO
Members can sign in with OIDC single sign-on (Okta, Auth0, Keycloak, Google, Microsoft Entra ID and other OpenID Connect providers). Configure providers under Settings → Authentication; see OIDC Single Sign-On for the full setup guide. OIDC login, just-in-time account creation and group-to-role mapping are free.
SSO sits alongside password login; it does not turn it off. Requiring SSO for every user with password login turned off, SAML 2.0 and SCIM provisioning are part of Temps Premium.