Teams & RBAC
Organize your team with role-based access control, project-level permissions, and a complete audit trail of all actions.
Creating a Team
Teams allow multiple users to collaborate on the same sh0 instance. The first user (created during installation) is automatically the team owner with full admin privileges.
- Navigate to Settings → Team in the dashboard.
- Your default team is created automatically. You can rename it here.
- Add a team description and avatar (optional).
Inviting Members
Admins invite new members by email address. sh0 sends no email: the invitation produces a one-time link, shown once to the person who invites, to pass on by your own means. The invited member opens it and chooses their own password; you never know it. Team members and roles require a Business license.
- Open Team in the sidebar.
- Click Invite User.
- Enter the email address and select a role (Admin, Developer, or Viewer).
- Confirm, then copy the Invitation link and send it to the person. It is valid for 7 days, for a single use, and will not be shown again.
curl -X POST https://your-server:9000/api/team/invite \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"email": "[email protected]",
"role": "developer"
}'Until the link is used, the member shows Invitation pending (then Invitation expired after 7 days). Generate access link issues a new link; the previous one stops working. From the CLI, sh0 users invite <email> --role developer prints the link the same way.
Role Types
sh0 provides three built-in roles with increasing levels of access:
| Role | Description | Use Case |
|---|---|---|
| Admin | Full access to all resources, settings, team management, and billing. | CTOs, DevOps leads, infrastructure owners |
| Developer | Can create, deploy, and manage apps. Cannot access team settings or server configuration. | Software engineers, DevOps team members |
| Viewer | Read-only access. Can view apps, logs, and metrics but cannot modify anything. | Stakeholders, QA team, auditors |
Permissions Matrix
Here is the complete breakdown of what each role can do:
| Action | Admin | Developer | Viewer |
|---|---|---|---|
| View apps & dashboards | Yes | Yes | Yes |
| View logs & metrics | Yes | Yes | Yes |
| Create & deploy apps | Yes | Yes | No |
| Manage environment variables | Yes | Yes | No |
| Manage domains & SSL | Yes | Yes | No |
| Access terminal | Yes | Yes | No |
| Manage team members | Yes | No | No |
| Server settings & nodes | Yes | No | No |
| Billing & license | Yes | No | No |
Project-Level Access
In addition to global roles, you can restrict a user's access to specific projects. This is useful when different team members work on different applications.
- Go to the project's Settings → Access tab.
- Click Add Member and select a team member.
- Choose the access level for this project (Full Access, Deploy Only, View Only).
Audit Log
sh0 records every significant action performed by team members. The audit log provides a complete timeline of who did what and when.
Tracked events include:
- Login and logout events
- App creation, deployment, and deletion
- Environment variable changes
- Domain additions and removals
- Team member invitations and role changes
- Settings modifications
- Database operations (backup, restore, delete)
curl https://your-server:9000/api/team/audit-log?page=1&per_page=50 \
-H "Authorization: Bearer YOUR_TOKEN"Removing Members
Admins can remove team members from Settings → Team → Members. Removing a member:
- Immediately revokes all their active sessions.
- Removes their access to all projects and resources.
- Does not delete any resources they created (apps, databases, etc.).
- Preserves their actions in the audit log for accountability.
curl -X DELETE https://your-server:9000/api/team/members/usr_abc123 \
-H "Authorization: Bearer YOUR_TOKEN"