Team & Projects

_{Updated May 8, 2026} Team & Projects is where you decide who has access to what on your Raff account. It has three pieces, each on its own tab:

​

Two separate permission systems — Account and Project

Raff splits permissions into two independent systems. They look similar in the UI but they cover completely different things, and granting one does not grant the other. A member’s grants are tracked separately in each system:

• Account roles are assigned once per member at the account level — they apply across the whole account
• Project roles are assigned per project — the same member can have Project Admin on customer1 and Viewer on staging, or no project role at all

An account role does not grant access to any project’s resources. A member with the Admin account role and no project roles can invite members, manage billing, see the list of projects’ names — but they cannot list VMs, see VPCs, or open any project’s resources. Project access has to be granted explicitly, per project. The Owner is the only exception: granted automatically at signup with full access in both systems on every project, current and future. Every other member you invite is scoped narrower than that. The Members list shows where each member sits with badges:

​

Projects — the unit of access control

Every resource on Raff lives in a project. VMs, volumes, public IPs, VPCs, Object Storage buckets — all of them are scoped to one project at creation time. Projects are how access control gets fine-grained. A few things every account should know:

• Every new account starts with a Default project. It’s pre-created at signup and used for any resource you create without picking a project explicitly. The Default project cannot be deleted — it’s the always-available fallback.
• You can create more projects. + Create Project from the Projects tab. Use them to isolate customers, environments (prod / staging), teams, billing entities, anything where access should be partitioned.
• Single project is fine. If you don’t need access partitioning, leave the Default project as your only project and forget about it. The account works the same way.
• Resources never leave their project. A VM created in customer1 stays in customer1. Today there’s no “move to another project” action — recreate elsewhere if you need to relocate.

​

How users switch projects

The top bar of the dashboard has a project picker next to the account name. Members with access to multiple projects use this to scope the dashboard to one project at a time. Whatever project is selected here, every list page in the dashboard filters to that project’s resources — Compute, Networking, Object Storage, all of it. Switch projects and the dashboard re-scopes immediately. The dropdown only lists projects the member actually has a project role on (the Owner sees all of them). The selected project also determines where new resources land — clicking + Create at the top right while customer1 is selected creates the new VM / volume / IP inside customer1.

​

What you can do

API keys are managed in a separate left-sidebar item, API Keys, not on the Team & Projects page. They’re tied to your account and inherit the scope you give them at creation.

---

​

Most viewed

---

​

Browse