# Organizations, members and keys

## Sign-in

Sign in with Google, GitHub, Microsoft (personal accounts) or email. People with Microsoft work accounts can use their work email. SAML and OIDC single sign-on for Enterprise is planned; tell us if you need it.

## Organizations

Everything in Veqen (calls, budgets, connections, keys, the bill) belongs to an organization. You can belong to several and switch from the menu at the top left. Each person can own one free organization.

## Roles

| Role | Can |
|---|---|
| Owner | Everything, including billing, promoting owners and deleting the organization |
| Admin | Everything except promoting owners: members, keys, budgets, connections, custom prices, bills, alerts, billing |
| Member | See spend, create ingest keys |
| Finance | See spend, record credits, set custom prices, enter provider bills, run and approve the monthly close |
| Viewer | See spend |

Invite people under Settings › Members. Invitations expire after seven days and can only be accepted by the email address they were sent to. Free organizations have two seats (members plus pending invitations); paid plans have no limit. An organization can send 20 invitations a day.

## API keys

| Scope | Can | Use it in |
|---|---|---|
| Ingest | Send calls, read budget status and account usage, read model volumes for `veqen diff` | Your applications |
| Full | Everything an ingest key can, plus read all spend through the API and connect MCP clients | CI (the GitHub Action), scripts, MCP clients without OAuth |

An organization can have up to 50 active keys. Keys look like `vq_live_<id>_<secret>`. Only a keyed hash of the secret is stored, so a key is shown once, when it's created. Members can create ingest keys and revoke the ones they created; owners and admins can create full keys and revoke any key. Revoking takes effect immediately.

When an owner or admin is demoted, removed or leaves, the full keys they created are revoked and their pending invitations are withdrawn. Their ingest keys keep working, so production traffic isn't interrupted; revoke those too if you need to.

## Audit log

On Pro and Team, Settings › Audit log lists who created or revoked keys, changed roles, invited or removed people, connected providers, changed budgets or billing, and approved or reopened a close. Events are kept for two years.