Teams: One organization. Access scoped by team.
Assign team-scoped API keys. Delegate model access and rate settings. Add members without seat charges.
Watch the key name the team.
How teams work.
Team-scoped API keys.
Issue virtual keys bound to a team so requests and spend attribute to that team automatically.
- The gateway resolves organization and team attribution from the virtual key
- Applies that team’s allowed models, RPM and TPM limits, budgets, and guardrails
- Passing team_id, org_id, or organization_id in request tags returns HTTP 400
Delegated model and rate settings.
Team Admins update allowed models and RPM or TPM limits for their assigned team without org-wide access.
- Team Admins create team keys and update their models, alias, and rate limits
- Owners and Organization Admins manage budgets, guardrails, and key revocation
- Team Admins receive HTTP 403 on organization settings and billing routes
No seat charges.
Add members and create teams at $0 per seat, with model usage billed separately at list price.
- Unlimited members, teams, and virtual keys on self-serve organizations
- Model usage is billed at the served model list price with a 0% platform fee
- Each user belongs to one team at a time, with a renameable Default team
Organization Admin vs Team Admin.
| Organization AdminOrganization-wide administration while billing ownership stays with the Owner. | Team AdminDelegated model, rate, and key controls on a single assigned team. |
|---|---|
| Creates and deletes teams, invites members, and assigns team membership and roles | Updates the assigned team name; cannot create teams or add and remove members |
| Configures model access, RPM and TPM limits, budgets, and guardrails across all teams | Updates allowed models and RPM or TPM limits for the assigned team; cannot change budgets or guardrails |
| Creates, edits, and revokes virtual keys across every team in the organization | Creates keys for the assigned team and updates their models, alias, and rate limits; cannot revoke keys |
| Views organization-wide spend and audit logs; cannot transfer organization ownership | Views own usage and readable team rosters; receives HTTP 403 on organization settings and billing |
FAQs
How do organization and team access boundaries work?
Every dashboard route and gateway request is scoped to your organization. Within an organization, teams scope virtual keys, model access lists, rate limits, budgets, and guardrails rather than creating private workspaces: team rosters and configuration remain readable to organization members, while organization-wide spend and team-wide spend rollups are restricted to Owners and Organization Admins.
Is there a per-seat cost for team members?
No. Self-serve organizations include unlimited teams, virtual keys, and members at $0 per seat. You pay only for the model usage your keys generate, settled at the served model list price with a 0% platform fee.
What roles are available and how do organization and team roles relate?
Permissions operate on two axes: organization membership (Owner, Organization Admin, Member, and Viewer) and team membership (Team Admin and Team Member). Owners manage billing and full organization administration. Organization Admins manage teams, invitations, member assignments, budgets, guardrails, and key revocation across the organization. Team Admins are organization Members granted authority on their assigned team to create team keys and update that team’s name, allowed models, and RPM or TPM limits. Viewers have read-only access and cannot create keys or run billable requests.
What can a Team Admin change, and what requires an Organization Admin?
A Team Admin can rename their assigned team, configure its allowed models and RPM or TPM rate limits, create virtual keys for that team, and update allowed models, alias, and rate limits on keys in that team. Adding or removing team members, revoking virtual keys, changing team budgets, and configuring guardrails require an Owner or Organization Admin.
Can a member belong to multiple teams or organizations?
No. Each user account belongs to one organization and one team within that organization at a time. An Owner or Organization Admin can move a member from one team to another at any time.
What happens to members when a team is deleted?
Every organization includes a Default team that can be renamed but cannot be deleted. When an Owner or Organization Admin deletes a custom team, its members are moved to the Default team before the custom team is removed.
How is request usage attributed to a team?
The gateway resolves the organization and team from the virtual key used to authenticate the request. To prevent callers from spoofing attribution, passing reserved keys such as team_id, org_id, or organization_id in x-nr-tags or nrouter_tags returns HTTP 400, while standard provider metadata fields on the request body are left untouched.
- Permissions operate on two axes: organization membership (Owner, Organization Admin, Member, and Viewer) and team membership (Team Admin and Team Member). Each user belongs to one organization and one team at a time, and every organization includes a renameable Default team that receives members when a custom team is deleted.
- The gateway resolves organization and team attribution from the virtual key on the request. Passing reserved attribution keys (team_id, org_id, or organization_id) in x-nr-tags or nrouter_tags returns HTTP 400, while provider metadata fields on the request body are left untouched.
- Self-serve organizations include unlimited members, teams, and virtual keys at $0 per seat. Model usage is billed separately at the served model list price with a 0% platform fee.