Control project access with roles
Web AppSecurityAccess Control
Projects now have four roles with different permissions:
| Role | Read Keys | Reveal Secrets | Write & Import | Project Settings | Transfer Ownership |
|---|---|---|---|---|---|
| Owner | Yes | Yes | Yes | Yes | Yes |
| Admin | Yes | Yes | Yes | Yes | No |
| Editor | Yes | Yes | Yes | No | No |
| Viewer | Yes | No | No | No | No |
Existing project members have been automatically migrated to the Editor role. Roles can be adjusted at any time from the Members page.
#Server-side enforcement
All key mutation routes—including bulk imports—and MCP tools reject write attempts from Viewers with 403 Forbidden. Remote MCP tokens are validated against active project membership before every key read, reveal, or write.
Learn more in the Projects & RBAC guide.