Tenant member management
Invite collaborators
Go to Console > Tenant Settings > Members. You'll see your current members and can invite more. Enter email addresses and assign roles (you can do this in bulk) and then send.
Logto lets you invite team members to your tenant with three different roles in Logto Cloud:
- Admin: Full access to the tenant, including its members and billing.
- Collaborator: Can view and change the tenant's resources, such as applications, users, connectors and the sign-in experience, but cannot manage members or billing.
- Viewer: Can view the tenant's resources and members, but cannot change them. Some credentials are hidden from viewers; see What viewers cannot see.
Role permissions
| Action | Admin | Collaborator | Viewer |
|---|---|---|---|
| View the tenant's resources and members | ✅ | ✅ | ✅ |
| Create, change and delete the tenant's resources | ✅ | ✅ | ❌ |
| Invite and remove members, change their roles, and view invitations | ✅ | ❌ | ❌ |
| Rename or delete the tenant | ✅ | ❌ | ❌ |
| Convert a Dev tenant to Production | ✅ | ❌ | ❌ |
| Add or remove the tenant's custom domains in Tenant settings > Domains | ✅ | ❌ | ❌ |
| Require MFA for members | ✅ | ❌ | ❌ |
| View the Plan and billing and Billing history tabs, upgrade or manage billing | ✅ | ❌ | ❌ |
| Leave the tenant | ✅ | ✅ | ✅ |
In the Console, viewers see a View only tag and banner. Buttons that create, save, delete or test are hidden, and fields are read-only.
What viewers cannot see
Viewers cannot read credentials that grant access to your Logto tenant or its users:
- Application secrets
- Your users' personal access tokens
- One-time tokens
- User password hashes
In the Console, application secrets and personal access tokens show as Hidden for viewers.
Viewers can still read other secrets in your tenant's settings, such as those in connector and enterprise SSO connector configurations, CAPTCHA secret keys, webhook signing keys, and environment variables of custom JWT scripts and Actions. Invite someone as a viewer only if you trust them with these.
Members limit
| Tenant type | Member limit |
|---|---|
| Dev tenant | Up to 3 members (contact us for more) |
| Free production tenant | 1 member (admin only) |
| Pro production tenant | 1 member included, then $8 per additional member |
Viewers count toward the limit and the per-member price like any other member.
Manage invitation
The invitation tab shows past invitations with their status
| Status | Explanation | Available action |
|---|---|---|
| Pending | Invitation sent, but not yet accepted. | Resend |
| Accepted | User is now a tenant member. | Delete |
| Expired | Invitation exceeded the 7-day limit. | Delete |
| Revoked | Admin cancelled the invitation. | Delete |
You can't invite people who already have pending invitations or are members.
Manage tenant members (Admin only)
As an admin, you have several ways to manage your team:
- Invite or remove members: Add new team members or remove access as needed.
- Change member roles: Assign 'admin', 'collaborator' or 'viewer' roles depending on the required access level.
- Transfer tenant ownership: If needed, you can transfer the ownership of the tenant to another member. You can first give the admin role to another member and then choose to stay as a regular member or leave the tenant entirely.
- Add multiple admins: Share administrative responsibilities with other team members for collaborative management.