Manage members and roles
Organizations, projects and environments, members and their roles, invitations, signing in through Cloudflare Access, and the audit log.
Organizations, projects, environments
An organization owns its members and its projects, and can add domains and send as soon as it exists. Only platform administrators create organizations, and the creator becomes its owner.
A project holds domains, keys, templates, webhooks and an audience. Each new project gets its two environments. A project's streams come from its domains: each domain sends either transactional or marketing mail.
A project's daily sending cap and key rate ceiling are set in Settings, Projects (Where limits apply); lowering the ceiling lowers every key above it. A project with domains cannot be deleted until they are removed, so their sending identities go with them.
Roles
Every member of an organization has one role there:
| Role | Can |
|---|---|
| Owner | Everything, including other owners, renaming and deleting the organization. |
| Admin | Members below owner, projects and environments, settings and SMTP credentials, sending broadcasts, alert rules. |
| Developer | Keys, domains, webhooks, templates, suppressions, inbound routes, mailboxes, audiences, broadcasts and automations; reads the rest. |
| Viewer | Reads everything and changes nothing. |
The rules for members:
- An admin may grant any role below owner; only an owner makes, changes or removes an owner.
- An organization always keeps one owner: the last owner cannot be demoted or removed. Make someone else an owner first.
- An organization has at most 50 members and open invitations.
- A role change or removal applies from the person's next request.
Someone who is not a member of an organization gets 404 not_found for anything in it, never 403, so other organizations stay invisible.
Inviting people
In the console, open Team and choose Invite member, with an address and a role.
- If the address has signed in to Minket before, the person becomes a member at once.
- Otherwise an invitation is saved. It is accepted on their first sign-in through Cloudflare Access with that address, within 14 days. Inviting the same address again renews it with the new role.
Open invitations are listed under Team, with their expiry, and can be revoked. Revoked and expired invitations are never accepted.
Signing in
The console sits behind Cloudflare Access: only people the Access policy allows can reach it, and Minket then applies their roles. On the first sign-in Minket pins the Access identity (sub) beside the address; a later sign-in with the same address but another identity is refused. If someone's identity provider account is replaced, an owner removes them and invites them again.
Every change in the console carries the console's own request header, so another site cannot make changes on someone's behalf.
The audit log
Every change made in the console or with an API key is recorded with who made it, what it touched and the values before and after: organizations, members, invitations (including acceptance), projects, the kill switch, environments, keys, domains, webhooks, templates, routes and the rest. Keys, secrets and message content never appear in it.
The Audit page lists the organization's changes newest first, filtered by change and project. Deleting an organization deletes its audit log with it.
Members on the API
A live full-access key lists the members of its organization by id and role. Their addresses and names are shown only in the console, since any project's key could otherwise read the whole organization's:
curl https://api.minket.com/v1/members -H "Authorization: Bearer $MINKET_API_KEY"const members = await minket.members.list();
// { object: "list", data: [{ id, object: "member", organization_id, user: { id }, role, created_at }], has_more }Members, invitations and roles are managed in the console only.