Teams and roles
A workspace belongs to the account that holds the Prompt Tracking package. The owner invites teammates from the Team page in the panel: Starter allows 2 users and Pro allows 5, the owner included.
Roles
| Role | In the panel | Highest key permissions |
|---|---|---|
| Owner | Everything, including team, billing and deleting panels | All scopes |
| Editor | Sets up and edits panels, prompts and competitors, starts measurements, manages share links | account:read, tools:read, tools:run, tools:orders, pt:read, pt:write |
| Viewer | Sees and exports data, changes nothing | account:read, tools:read, tools:orders, pt:read |
On Starter every teammate is an editor. Roles and client scopes are available on Pro.
Keys of team members
A key belongs to the person who created it and works in the workspace that was selected when it was created. It uses the workspace package, credits and limits, and the workspace shares one key pool (Pro: 3 keys). Apps you connect over OAuth work the same way: the consent screen shows the workspace.
What a key can do is the intersection of what you granted it, what the package allows today and what your role allows today. If the owner changes your role, the key follows on the next request. Deleting a panel, disconnecting Google and changing account settings need the owner role and return 403 role_forbidden for teammates.
If a client scope is set for you, panels outside it return 404 not_found, exactly as panels of another account.
When access ends
If you are removed or you leave, your keys and connected apps in that workspace are revoked at once. If the package changes and the user limit is exceeded, access is suspended and requests return 401 account_inactive until a seat is free again. The owner can see and revoke every key in the workspace.
Team management itself (invitations, roles, removing members) is only available in the panel, never over the API or MCP.
Agency clients (Pro)
On Pro you can group panels by client. GET /v1/clients lists clients with their panel ids, POST /v1/clients creates one, PATCH /v1/clients/{client_id} edits or archives it and PUT /v1/panels/{panel_id}/client assigns a panel (null removes the assignment). Writes accept dry_run. GET /v1/workspace/members lists the team with masked emails for owners and editors. In MCP the same actions are list_clients, create_client, set_panel_client and list_members.
Client portal links and the agency brand are managed only in the panel.
GET /v1/me shows the workspace, your role and the seat count.