# Teams and the audit log One Runtime account can have as many people as you need. They share its credit, its sandboxes and other resources, and its keys. Each person has a role, and every change to members, keys, money and security settings goes into an audit log with who made it, when, and from which address. Every account starts with one person, its owner. Nothing changes until you invite someone. ## Roles | What they can do | Owner | Admin | Developer | Billing | | ----------------------------------------------------------------- | :---: | :---: | :-------: | :-----: | | See resources, usage, balance, keys and members | yes | yes | yes | yes | | Start, run and delete sandboxes and other resources, using credit | yes | yes | yes | — | | Create API keys and approve CLI connections | yes | yes | yes | — | | Revoke or limit a key somebody else made | yes | yes | — | — | | Add credit and see payments | yes | yes | — | yes | | Invite, remove and change the role of members | yes | yes | — | — | | Read the audit log | yes | yes | — | — | | Make someone an owner, or change or remove an owner | yes | — | — | — | - An account always has at least one owner. To hand an account over, make the new person an owner, then leave or change your own role. - Anyone can leave an account, and anyone can revoke a key they made. - A key can never do more than the person who made it. Runtime checks that person's role on every request, so changing someone from developer to billing makes their keys read-only at once. ## Invite people Owners and admins invite people at [Members](https://withruntime.com/account/members): enter an email address, choose a role and choose **Send invitation**. - The person gets an email with a link. The page also shows the link, so you can send it yourself. - The link works once, for seven days, and only for someone who signs in with that email address. A forwarded link is no use to anyone else. - Someone new to Runtime signs up through the link and lands in your account. Someone who already has an account keeps it and joins yours as well. - Sending an invitation again to the same address replaces the first one. **Withdraw** cancels an invitation that has not been used. - An account can have 50 open invitations and send 25 in any 24 hours. ## Several accounts A person can belong to several accounts, such as their own and their company's. - **Website:** choose the account from the name at the top right of any account page. Runtime remembers the choice in this browser. - **Connecting an agent:** when you approve a connection or a key request, the approval page asks which account it is for. - **CLI:** every account you connect is saved on the machine. ```bash no-run npx withruntime account add # connect another account; choose it in the browser npx withruntime account # list them; * marks the one in use npx withruntime account switch Acme # use Acme for every command after this ``` - **SDKs and the API:** a key belongs to one account, so use that account's key. `GET /v1/me` names the account and the role of the person who made the key. ## Keys in a team Keys belong to the account, not to the person. Everyone who can see the account sees every key, with who made it, at [API keys](https://withruntime.com/account/keys). - Each key is its own agent, so the audit log and the bill say which key did what. - The person who made a key sets or changes its daily spending limit. Owners and admins can limit or revoke any key. - When someone leaves or is removed, the keys they made are revoked in the same step. What they created, such as sandboxes, volumes and images, stays with the account. ## Leaving and removing On [Members](https://withruntime.com/account/members): - **Leave** takes you out of an account. The last owner cannot leave until there is another owner. - **Remove** takes someone else out. Admins remove developers, billing members and other admins; only an owner removes an owner. - Either way, the person loses access at once and their keys stop working. They can be invited back, with a new role if you like. ## Audit log Owners and admins read the audit log at [Audit log](https://withruntime.com/account/audit). It records: - **Members:** joined, added, removed, left, and role changes; invitations sent and withdrawn - **Keys:** created and revoked; CLI connections and key requests approved or denied; spending limits set and removed - **Credit:** top-ups started, credit bought, granted, earned by referral, refunded, disputed, taken back or expired - **Security settings:** network rules, secrets created, updated, rotated, revealed and deleted (never the value), preview ports made public or private - **Deletions:** volumes, images, snapshots, services and jobs - **The account:** created, renamed, suspended and restored Each entry has the action, who did it (a person, a key, or Runtime itself for things like a card payment), the time, the client's IP address, the request id and whether it came through the website, the API or MCP. Sandbox starts and stops are not in the audit log; each sandbox has its own history. Entries are kept for at least 400 days. Nobody can edit an entry, and none is deleted before then. ### Read it from code A key made by an owner or admin reads the log, if it has full access or is read-only. Newest first, 50 at a time by default, up to 200. ```bash no-run curl -H "Authorization: Bearer $RUNTIME_API_KEY" \ "https://api.withruntime.com/v1/audit?action=member.&limit=100" npx withruntime audit --action key. ``` ```ts check import { Runtime } from "withruntime"; const runtime = new Runtime(); const { events, next } = await runtime.audit.list({ action: "credit." }); console.log(events.length, next); ``` ```python check from withruntime import Runtime with Runtime() as runtime: page = runtime.audit.list(action="credit.") print(len(page["events"]), page["next"]) ``` - `action` is one action, like `key.created`, or a group ending in a dot: `member.`, `invitation.`, `key.`, `connection.`, `limit.`, `credit.`, `network.`, `secret.`, `preview.`, `resource.`, `account.`. - `next` is the page's last entry. Pass it as `before` for older entries. - MCP: the `runtime_audit_list` tool, with the same filters. - A key made by a developer or billing member, or a key limited to selected actions, gets `403 forbidden`. ## Sign-in People sign in with an email link or with Google. Single sign-on through SAML or OIDC (Okta, Microsoft Entra ID and others) and SCIM provisioning are not available yet. If your company needs them, tell us with `npx withruntime feedback "SSO: "`.