Teams & Multi-User Access

Collaborate on DNS infrastructure with role-based access control.

Overview

Every hiddenprimary.ch account belongs to a team (also called tenant). You can invite colleagues to your team and control what they can do with roles. Users can be members of multiple teams and switch between them.

Roles

RolePermissions
Owner Full access. Manage billing, team members, zones, API keys, and account settings. Every team must have at least one owner.
Admin Manage zones, DNSSEC, transfers, webhooks, and vanity NS. Cannot change billing, remove owners, or create API keys — a key carries the whole team's permissions, so only the owner issues one.
Viewer Read-only access to zones, records, stats, and validation results. Cannot create, modify, or delete anything.

Roles are hierarchical: Owner > Admin > Viewer. Each higher role includes all permissions of the lower roles.

Invite a Team Member

Go to Account → Team in the portal and click Invite Member. Enter the email address and select a role.

The invited user receives an email with a link to accept the invitation. If they don't have an account yet, they will be prompted to register first.

terminal
$ curl -X POST https://hiddenprimary.ch/v1/team/invitations \
  -H "Authorization: Bearer $HP_KEY" \
  -H "Content-Type: application/json" \
  -d '{"email":"colleague@example.com","role":"admin"}'

The API does not send the email. It returns a one-time token in the response; the link is https://hiddenprimary.ch/invite/<token> and you pass it on yourself.

Inviting needs a plan that includes Multi-User access. Without it the portal shows an upgrade notice in place of the invite form and the API answers 402. Members you already have and invitations already sent stay visible and removable on every plan.

Accept an Invitation

Click the link in the invitation email. Once accepted, the team appears in your team switcher in the portal navigation. You can switch between teams at any time.

Switch Teams

If you belong to multiple teams, use the team switcher in the top navigation to change your active team. All portal views and API calls operate in the context of the active team.

Manage Members

Every member sees the team list under Account → Team. Owners and admins can remove members and cancel invitations; only an owner can change a role.

  • An owner cannot be removed, and the last owner cannot be demoted — every team keeps at least one.
  • You cannot change your own role.
  • Removing a member revokes their access immediately.
  • Pending invitations can be cancelled before they are accepted.

API Keys & Teams

API keys belong to the team, not to individual users, and only an owner can create one. API key authentication skips role checks — the key's scopes determine what it can access.

Next Steps