# Team Management

Invite teammates into your OneHazel organisation, each with their own login. Everyone in the organisation shares the same connectors, workflows, connections, and data — there's no need to share a single password or API key.

> **Where to find it:** sign in at [app.onehazel.com](https://app.onehazel.com) and open **Account → Team** in the sidebar. The Team page is visible to **Owners** and **Admins**. (Members don't see it — they already have full access to the org's data.)

## How organisations work

A OneHazel organisation is a single workspace. When you signed up, you became its **Owner**. Inviting a teammate creates a brand-new login for them that joins your workspace — they see the same Marketplace, Connections, Workflows, and Analytics you do.

Each person has a **role** that controls whether they can manage other teammates:

| Role | Manage members? | Access org data, connectors & workflows? |
|---|---|---|
| **Owner** | Yes — full control | Yes |
| **Admin** | Yes — but Members only | Yes |
| **Member** | No | Yes |

There is exactly **one Owner** per organisation. The Owner can't be removed or demoted from the Team page; transferring ownership is a separate flow (contact support if you need it).

## What each role can do

### Owner
- Invite Admins and Members.
- Change any teammate's role between Admin and Member.
- Revoke (suspend) and reinstate Admins and Members.
- Everything a Member can do.

### Admin
- Invite **Members** (Admins can't invite other Admins).
- Revoke (suspend) and reinstate **Members**.
- Admins **can't** change, revoke, or reinstate the Owner or other Admins.
- Everything a Member can do.

### Member
- Full access to the organisation's connectors, connections, workflows, and analytics.
- **Can't** see or use the Team page, invite anyone, or change roles.

> Owners and Admins manage *people*. All three roles have the same access to the *org's data and integrations*. Roles are about team administration, not data permissions.

## Inviting a teammate

1. Open **Account → Team** and click **Invite member**.
2. Enter the teammate's **email address**.
3. Choose a **role**:
   - **Member** — full access to org data (the default).
   - **Admin** — can also manage members. *Only Owners can grant the Admin role.*
4. Click **Send invite**.

OneHazel emails the teammate an invite link. The invite **expires after 7 days**.

> **Email didn't arrive?** Right after sending, the Team page shows a **copy-able invite link** for that invite — share it directly (e.g. over Slack) if the email is slow or filtered. You can also use **Resend** later (see below), which generates a fresh link.

::: tip One account per email
An email address can belong to only one OneHazel organisation at a time. If the address already has an account, the invite is rejected with *"That email already has a OneHazel account."* Multi-organisation access is on the roadmap.
:::

## Accepting an invite (what your teammate sees)

When the invited person clicks the link in their email, they land on the **Accept Invite** page (no existing account needed). They'll see:

1. The name of the organisation they're joining and their assigned role.
2. Their **email**, pre-filled and locked (it's the address you invited).
3. Fields for their **First name** and **Last name**.
4. A **password** they choose (minimum **8 characters**), entered twice to confirm.

After they click **Accept invite & continue**, OneHazel creates their login inside your organisation and signs them straight in — they land in the shared dashboard.

If the link is no longer usable, the page explains why instead of showing the form:

| What they see | Why |
|---|---|
| *"This invite link is invalid."* | The token is wrong or the invite was never created. |
| *"This invite has expired."* | More than 7 days passed. Resend it. |
| *"This invite has already been used."* | Someone already accepted it. They should sign in instead. |
| *"This invite was revoked."* | An Owner/Admin cancelled it. Send a fresh one. |

## Managing pending invites

Pending invites appear in their own table on the Team page. For each one you can:

- **Resend** — issues a **new** invite link (the old link stops working) and re-emails it. Use this if the original expired or got lost.
- **Revoke** — cancels the invite. The link immediately stops working.

Re-inviting the same email simply refreshes the existing pending invite rather than stacking duplicates.

## Revoking and reinstating members

To remove someone's access, click the **Revoke** (trash) icon next to their row. Revoking:

- **Signs the member out immediately** and blocks them from signing back in. Their next request is rejected and they're returned to the sign-in screen with an "access removed" message. (Under the hood this is the `MEMBER_ACCESS_REVOKED` response — see the [API reference](/api-reference/team-management).)
- Moves them to a **Suspended** section on the Team page, where you can **Reinstate** them later in one click. Reinstating restores their access right away.

::: warning API keys survive revocation
**API keys belong to the organisation, not the individual.** Revoking a member does **not** revoke any API keys they created — those keys keep working. If a departing teammate created keys you no longer trust, revoke them separately under **Account → API Keys**. (See [API Keys](/api-reference/api-keys#revoke).)
:::

You can't revoke or change your **own** membership, and the **Owner** can never be revoked.

## What's next?

- [App Onboarding](/app-onboarding) — set up your workspace from signup to first integration.
- [Authentication](/authentication) — API keys and how org members authenticate.
- [Team Management API](/api-reference/team-management) — the endpoints behind the Team page.