Invite people and choose what each of them can do.
| Role | Can do |
|---|---|
| Owner | Everything, including billing, API keys and approving changes. |
| Admin | Same as owner: domains, DNS, members, API keys and approvals. |
| Billing admin | Saved card, orders, invoices and who holds the domains. |
| Domain manager | Prepares domain settings, contacts and DNS; an owner or admin approves. |
| DNS operator | Prepares DNS changes; an owner or admin approves. |
| Viewer | Reads everything, changes nothing. |
AI agents use API keys, never a role: each key has its own scopes and expiry, and anything risky waits in Approvals.
YOUR SIGN-IN
Signing in with Google again only proves the browser still has a Google session. A passkey asks for your fingerprint, face or PIN, so a stolen browser session cannot approve auth codes, nameserver or registrant changes.
