Invite a member

Documentation Index

Fetch the complete documentation index at: https://docs.rafftechnologies.com/llms.txt

Use this file to discover all available pages before exploring further.

_{Updated May 8, 2026} This page walks the Invite Team Member flow on the Team & Projects page, plus the after-acceptance flow for adding more access (more projects, or account-level access) to a member who’s already on the team — without resending an invite.

​

Who can invite

Anyone with the account.members.invite permission can send invitations. The Owner has it automatically; the Admin account role has it; Billing and Member account roles do not have it. Project-only members cannot invite anyone. If you don’t see the + Invite Member button on the Members tab, your role doesn’t include account.members.invite — ask the Owner or an Admin to either send the invite or grant you the permission via a Custom role.

​

1. Open the Members tab

In Team & Projects → Members, click the orange + Invite Member button in the top right. The Invite Team Member dialog opens.

​

2. Email Address

Type the recipient’s email. They’ll receive an email with a link to accept; clicking it walks them through password setup (or login if they already have a Raff account on the same email) and lands them in your account scoped to whatever access you assigned.

​

3. Pick the Access Level — Account or Project

This is the most important choice in the dialog. The two options are mutually exclusive at invite time, and they map to the same two-system permission model from Roles, scopes, and the Owner.

​

Account access level

Pick Account when the new member should have account-wide responsibilities — billing, settings, audit log, members management, the project list, account-wide API keys. The dialog labels this “Billing, settings, all projects” — that copy is a shorthand. Concretely, an Account-level invite grants the chosen Account role’s permissions, which always sit in the account.* domain. It does NOT automatically grant access to resources inside projects. A member invited at Account level with the Admin role can manage account settings and the project list — but can’t see VMs, VPCs, or any project-internal resources unless you also add project-level access (covered later on this page). After picking Account, the Role dropdown shows the Account roles available — the System ones (Admin, Billing, Member) plus any Account-scoped Custom roles you’ve created. Pick the role and click Send Invitation.

​

Project access level

Pick Project when the new member should only access resources inside specific projects. The dialog labels this “VMs & resources only” — that’s the accurate summary: project-level invites grant only resource access inside the chosen project. When you pick Project, two extra fields appear: Click Send Invitation. The invitee gets an email; once they accept, they show up on the Members list with the Project-only badge.

​

4. Send Invitation

Either path ends with the orange Send Invitation button. The email goes out, and the invitee appears on your Members list immediately as Pending until they accept. They have a few days to act on the link; resend from the row’s ⋮ menu if it expires.

​

After they accept — adding more access

Once a member has accepted even one invite (Account or Project), they’re a member of your account. From that point on, you don’t need to send another email invite to expand their access. The Members list lets you grant additional Account access or additional Project access directly from the row. Click the chevron on the left of any member’s row to expand it. The expanded row has two sections, each independently manageable:

​

Account Access

The top section shows the member’s account role. If they don’t have one (the screenshot shows No account-level access. This user can only access specific projects below.), the section just lists an Add to Account button.

• Add to Account — opens a dialog with the same Account role picker from the invite flow. Grants the member an account role on top of any project roles they already have. No email, no acceptance step — they have it immediately on next page load.
• If they already have an account role, this section shows the role with a row menu to change it (Change Role) or remove it.

​

Project Access

The bottom section lists every project the member has a role on, with the role shown as a badge on each row (Project-operator, Project Admin, etc.). Each row has a ⋮ menu to change or remove the role.

• + Add to Project — adds the member to another project with a Project role you pick. The member gains access to that project’s resources immediately.

This is how you build the typical “started with one project, now needs another” growth pattern — invite once, add projects as the member’s responsibilities grow.

​

What “Project-only” really means

The Project-only badge on the Members list is shorthand for “this member has at least one project role, but no account role at all.” In access terms:

• They can sign in and use the dashboard
• They see only the projects they’ve been added to (the project picker in the top bar lists those projects only)
• Inside each of their projects they can do whatever the project role allows
• They cannot see members of other projects, account settings, billing, audit logs, or the role catalog
• They cannot create or manage account-wide API keys

This is the right scope for external customers (one project per customer), contractors (one project for the engagement), or per-team isolation (each team gets its own project). They have what they need for their workload, nothing else. To promote a Project-only member to also have account access, expand the row → Add to Account → pick an Account role. To demote, do the reverse: open Account Access → row menu → Remove.

​

Email and acceptance

The invitation email comes from a no-reply Raff address with the subject “You’ve been invited to…” — accepted invites land the member in your account on next sign-in. If the recipient already has a Raff login on the same email, they don’t create a new password; they just see your account in their account switcher. If you typed the wrong email, cancel the invite from the pending row’s ⋮ menu and send a new one. Pending invites do not consume a member slot.

​

Related