# Team and roles (/settings/team)

Go to **Settings → Team** to invite teammates and manage their access to Keel HQ.

## Roles [#roles]

| Role | What they can do |
| --- | --- |
| **Owner** | Full access, can transfer ownership. |
| **Admin** | Can invite, manage members and settings. |
| **Member** | Can edit data and content. |
| **Viewer** | Read-only access. |

Only admins can invite people or manage the team. Only the owner can change or remove another admin. Keel HQ refuses an invitation when that email address is already a confirmed or pending member of the team.

## Invite a teammate [#invite-a-teammate]

<Steps>
<Step>

### Open Team [#open-team]

Go to **Settings → Team**. In **Invite Member**, enter the person's **Email address**.

</Step>
<Step>

### Choose a role and access [#choose-a-role-and-access]

Choose **Admin**, **Member** or **Viewer**. **Member** is selected by default.

For a Member or Viewer, choose their module access. See [Limit access to selected modules](#limit-access-to-selected-modules) for what that means.

</Step>
<Step>

### Send the invitation [#send-the-invitation]

Choose **Send invite**. The person appears in **Team Members** as **Pending** until they accept it.

</Step>
</Steps>

The invitee opens the link in their invitation email and chooses **Accept invitation**. If they are new to Keel HQ, they set their first password before opening the workspace. Keel HQ account creation is invite-only, and it has no Google or social sign-in option.

## Manage members and invitations [#manage-members-and-invitations]

Each row in **Team Members** shows the person's role and either when they joined or, for an invitation, when they were invited.

- For a pending invitation, choose **Revoke** to cancel it.
- For a member, use the role control to change their role. Only the owner can change an admin's role.
- Choose **Remove**, then confirm **Remove?**, to remove a member. Only the owner can remove an admin.

## Limit access to selected modules [#limit-access-to-selected-modules]

Members and Viewers can have **All modules** or **Only selected modules**. With selected access, choose one or more of these modules:

- Inventory
- Cash
- Ads
- Marketing
- Warehouse
- Reports

Selected-module members cannot open Overview, The Helm, the Journal or workspace Settings because those areas show data across modules. They can still open **Settings → Profile**. Admins always have access to every module.

## API tokens after an access change [#api-tokens-after-an-access-change]

If you demote an admin to Member or Viewer, or limit a Member's access to selected modules, API tokens they created as an admin become inactive. Inactive tokens still count toward the workspace limit of three live tokens, so the team row identifies them and lets an admin revoke them if needed. Restoring full admin access makes them usable again.

For token status, limits and revocation, see [API tokens](/reference/api-tokens).