Skip to main content
Everyone in your Bindbee organization is either an Admin or a Member. There are only these two roles and they are not configurable. A third set of activities sits outside the role system entirely, governed by credentials rather than by role.

​
The two roles

​
Admin-only capabilities

Everything on that list touches a live customer or a real credential, and none of it is easy to undo. Inviting users is here because a Member who could invite people could grant themselves the rest. Keep more than one Admin. An Admin cannot act on their own account, so a single Admin cannot be removed or demoted by anyone.

​
What a Member can do

Anything not listed above is open to both roles. In particular, a Member can:
  • Create a Production connector, where the organization has production access, and create Development connectors freely.
  • Regenerate the Development API key.
  • Enable or disable integrations, and change which models and fields are in scope.
  • Operate connectors in both environments - resync, upload files for file-based integrations, and delete Development connectors.
  • View API logs, webhook delivery logs and response bodies, which may contain customer data.
  • Fully manage webhooks, including viewing and rotating the signing secret.
  • Fully manage custom fields and mappings, including inspecting raw source data.
  • View organization members and their roles, and update branding.
Scope applies across every connector, integration and environment, so a Member changing it changes what syncs for all of your customers - see Scoping.

​
Outside the role system

Some activities are governed by credentials or a secure link rather than by role:
  • Signing in and resetting a password
  • Single sign-on
  • Completing a Magic Link flow
  • Authorizing an integration through OAuth
  • Calling the unified APIs with organization and connector credentials
Holding an Admin or Member role does not by itself grant access to any of these.

​
What organization API credentials allow

An API key identifies the organization and whether a request is Development or Production. Some calls also need the matching connector_token, so access is limited to one connection.
Treat API credentials as secrets. Anyone holding a valid organization key and connector token can read customer data or make supported changes in a connected system, whatever their Dashboard role.
These roles and keys cover Bindbee, not your own product. Bindbee authenticates your service, not your end users.