Members and invites
Invite by email with a role: the invite is emailed, and its link works once, for seven days, and only for the invited address as verified by the sign-in. Suspend, remove or change a role at any time; the next request sees it.
Enterprise
One tab for the whole team.
Bring the people who run your agents into one flock: each with a role, every action checked against it, passkeys when you want them, and one view of what everyone's agents spend.
Provisioning (SCIM)
Connect Okta, Microsoft Entra ID or Google Workspace over SCIM 2.0. People your identity provider adds join with their role at first sign-in; deactivate them there and they are suspended here.
Roles and permissions
15 permissions, from seeing spend to managing members. Owner, Admin, Developer, Finance and Viewer are built in; make your own roles from the same list. Nobody can give a role more than they hold themselves.
Limited to some projects
Give a contractor or a team lead a few projects: they change Agents, keys and bills there and nowhere else, and never manage the flock.
Checked on every request
Every console page, every action and every console API asks for its permission before it answers. A Viewer cannot close a tab through the API any more than through the page.
Passkeys
Touch ID, Windows Hello, a phone or a security key: sign in with one alone, or use it as a second proof. Require one for every member: until a browser proves a passkey, the console and its APIs stay shut.
Single sign-on
Okta, Microsoft Entra ID, Google Workspace or any OIDC or SAML 2.0 provider. People on your domains sign in through it, new ones join with the role you pick, and you can require it for everyone but the owner.
The bird's-eye view
What the whole flock spent, through the tab and outside it, by day, project, person and Agent. Click a day to see it in full. Subscription use is priced at list beside the total, never inside it.
Outside spend, added by the team
Admins and developers connect vendors or record a bill by hand, attributed to a project. Finance and viewers read it; nobody else can change it.
Audit log
Who invited whom, changed a role, suspended a member, tightened the passkey rule, added a passkey or recorded a bill, and when.
Invite domains
Limit invites to your own email domains. The limit is checked when the invite is made and again when it is accepted.
On a phone too
The whole Enterprise section works on a phone: members, approvals, passkeys and the spend view, with every action in reach.
Built-in roles
Start from these, or make your own from the same 15 permissions.
| Role | What it is for | Can |
|---|---|---|
| Owner | Created the flock. Everything, and cannot be removed or demoted. | everything |
| Admin | Everything the owner can do, except remove the owner. | everything |
| Developer | Runs Agents: Tabs, keys, projects, subscriptions, and adds outside spend. | See spend · Run Tabs · Issue keys · Subscriptions · Projects · See outside spend · Add outside spend · See members |
| Finance | Reads every figure, owns billing and the audit log. Changes nothing an Agent runs on. | See spend · See outside spend · Billing · See members · Audit log |
| Viewer | Reads spend and outside spend. Changes nothing. | See spend · See outside spend · See members |
Part of Fleet
Enterprise comes with Fleet, from $199/mo. The same hard caps, kill switch and your own provider keys as every plan; now for a team.