Account and payment
Team and roles in an organization
How to invite a colleague to your organization, which role to give, what each role can do, how to change a role or remove a person and where the sign-in log is.
Under Team → People and access you see everyone who works in the organization, their roles and the invitations still waiting. Owners and administrators manage the team.
Roles
A role defines what a person can do. API keys are never stronger than their role: a key can't do more than its owner.
| Role | What it can do |
|---|---|
| Owner | Everything, including moving domains to another registrar (the transfer code), renaming the organization and managing owners |
| Administrator | Domains, DNS, domain contacts, the transfer lock, monitoring, money and documents, the team, API keys |
| Technician | See domains, change DNS, set up monitoring, issue API keys; no money |
| Accountant | See domains and the balance, pay and top up the balance, download invoices and acts; no DNS |
| View only | See domains, the balance and invoices; changes nothing |
An organization always keeps at least one owner.
How to invite a person
- Open Team → People and access and click "Invite".
- Enter your colleague's email and choose a role.
- Click "Send invitation".
The colleague gets an email with a link. The invitation is valid for 7 days. Signing in through it requires two-step verification — the colleague sets it up while signing in. Until accepted, the invitation is marked "invited …, not accepted yet"; you can withdraw it with "Cancel invitation".
Change a role or remove a person
- Find the person in the list and choose a new role in their row — they get an email about it.
- To remove them, click "Remove from team". You can undo this within 60 seconds.
You can't demote or remove yourself in this list.
Owners: extra care
The owner role gives the most rights, so special rules apply:
- Only an owner can grant the owner role, take it away or remove an owner — and only after an explicit "Yes, confirm".
- A new owner gets the domain transfer code only after 72 hours, and during those 72 hours can't demote or remove you.
- Invite someone as owner only if you know them personally.
If a colleague's access was recovered
When a colleague has recovered access to their account (for example, lost a phone), the list shows "Restricted after access recovery until …" next to them. Until that date they can't change name servers, contacts or the team of this organization.
If you are sure it really is them, click "Confirm it's really them". Check by voice or in person, not by email or a messenger from this account: an attacker may have recovered it. Confirming lifts the restriction.
Sign-in log
At the bottom of the page is the "Sign-in log" for 30 days: who signed in, when, from where and how, whether it was a new device and whether a sign-in was rejected because of a wrong code. People who manage the team can see it.
If it didn't work
- "The address looks wrong" — check your colleague's address.
- "This person is already on the team" — no need to invite again.
- "The invitation is invalid or expired — ask for a new one" — the 7 days have passed or the invitation was withdrawn. Send a new one.
- "A different role in the organization is needed for this" — only an administrator or an owner can do this.
- "Only an owner can change an owner's role" / "Only an owner can remove an owner" — ask an owner to do it.
- "The organization must keep at least one owner" — make someone else an owner first.