Team Management
Invite team members, assign roles, and manage permissions
RevKeen allows you to invite team members to your organization and assign them roles that control their access to different features. This guide explains how team access works, the available roles, what each one can do, and security best practices.
How team access works
RevKeen separates two ideas:
- Membership — who is on your team. You invite people by email; they accept and join your organization.
- Role — what each member can do. Every member has exactly one role, and that role decides which actions they're allowed to take.
Roles are enforced by RevKeen's backend on every request, not just hidden in the dashboard. Showing or hiding a button is a convenience; the server is what actually allows or denies each action. This means a member can never perform something their role doesn't permit — including through the API or any integration. Changing a member's role takes effect immediately.
Team roles
RevKeen uses a role-based access model to control what each team member can do in your account. There are six roles:
| Role | Description | Typical use |
|---|---|---|
| Owner | Full control, including team, permissions, billing, and payment rails | Business owner / primary account holder |
| Admin | Manage everything except the permission model itself — settings, team, money movement, and integrations | Operations managers, senior staff |
| Finance Manager | Invoices, payments, refunds, mandates, Direct Debit, subscriptions, and disputes | Finance / accounting |
| Developer | API keys, webhooks, integrations, and checkout configuration (no money movement) | Engineers, technical integrators |
| Support | Read access to all data, plus sending invoices and responding to disputes | Customer support |
| Viewer | Read-only access | Stakeholders who only need visibility |
These roles apply to your merchant team — the people who work in your RevKeen account. They are separate from RevKeen's internal platform/operations roles.
Role permissions
Each role has a different level of access. Every role can view your account data; the differences are in what they can change.
Owner
- Everything Admin can do, plus managing the permission model, billing/plan, and payment rails
- The only role that can change what other roles are allowed to do
- Every account must keep at least one owner
Admin
- Manage account settings, team members, and payment rails
- Full money movement: process payments, issue refunds, send/void/delete invoices, manage subscriptions, mandates & Direct Debit, and disputes
- Manage API keys, webhooks, integrations, and checkout
- Cannot change the permission model (owner only)
Finance Manager
- Full invoicing: create, edit, send, void, delete, mark paid
- Process payments and issue refunds
- Manage subscriptions, mandates, and Direct Debit
- Respond to and resolve disputes
- Cannot manage the team, settings, API keys, webhooks, or integrations
Developer
- Manage API keys (create, rotate, revoke)
- Manage webhooks and integrations (connect, configure, sync)
- Configure checkout
- No money movement — cannot process payments, issue refunds, or edit invoices
Support
- Read access to customers, invoices, payments, subscriptions, and disputes
- Send invoices to customers
- Respond to disputes and submit evidence
- Cannot issue refunds, change settings, or manage the team
Viewer
- Read-only access to dashboards, reports, and data
- Cannot modify anything
Permission matrix
| Permission | Owner | Admin | Finance Manager | Developer | Support | Viewer |
|---|---|---|---|---|---|---|
| View dashboards & data | Yes | Yes | Yes | Yes | Yes | Yes |
| Send invoices | Yes | Yes | Yes | -- | Yes | -- |
| Create / edit / void / delete invoices | Yes | Yes | Yes | -- | -- | -- |
| Process payments & issue refunds | Yes | Yes | Yes | -- | -- | -- |
| Manage subscriptions | Yes | Yes | Yes | -- | -- | -- |
| Manage mandates & Direct Debit | Yes | Yes | Yes | -- | -- | -- |
| Respond to disputes | Yes | Yes | Yes | -- | Yes | -- |
| API keys, webhooks & integrations | Yes | Yes | -- | Yes | -- | -- |
| Checkout configuration | Yes | Yes | -- | Yes | -- | -- |
| Account settings & payment rails | Yes | Yes | -- | -- | -- | -- |
| Manage team | Yes | Yes | -- | -- | -- | -- |
| Manage permissions & billing plan | Yes | -- | -- | -- | -- | -- |
Every organization must have at least one owner. You cannot remove or demote the last owner without first assigning ownership to another member.
Team member list
Navigate to Settings > Team Members to view all team members. The list displays:
| Column | Description |
|---|---|
| Name | Team member's name |
| Login email address | |
| Role | Assigned role (Owner, Admin, Finance Manager, Developer, Support, Viewer) |
| Status | Active, pending invite, or suspended |
| Last Active | Last login date |
Inviting team members
Owners and admins can invite new team members:
- Navigate to Settings > Team Members
- Click Invite Member
- Enter the invitee's email address
- Select a role (Admin, Finance Manager, Developer, Support, or Viewer)
- Optionally add a personal message
- Click Send Invite
The invitee receives an email with a link to create their account and join your team.
Pending invites expire after 7 days. You can resend the invitation from the Team Members page.
If an invitation email does not arrive, check the spam folder. You can also resend invitations from the Team Members page.
Managing existing members
From the Team Members page, you can:
- Change roles -- Promote or demote members between roles
- Remove members -- Revoke access for team members who no longer need it
- Resend invitations -- Send another email for pending invitations
- Revoke invitations -- Cancel pending invitations before they are accepted
Changing roles
- Find the team member in the list
- Click the actions menu
- Select Change Role
- Choose the new role
- Click Update
Changing a member's role takes effect immediately. They may lose access to certain features.
Removing team members
- Find the team member in the list
- Click the actions menu
- Select Remove
- Confirm the removal
Removed members immediately lose access but their activity history is preserved.
Removing a member is immediate and permanent. The member will lose access to all organization data instantly. They can be re-invited later if needed.
Suspending members
Temporarily disable access without removing a member:
- Find the team member
- Click Suspend
- They cannot log in until reactivated
- Reactivate anytime to restore access
Best practices
- Use the principle of least privilege -- Assign the minimum role needed for each team member's responsibilities
- Have multiple owners for business continuity -- Ensure at least two people have owner access in case of emergencies
- Review team access regularly -- Periodically audit your team members and remove access for those who no longer need it
- Use work email addresses -- Invite team members using their company email for better security and tracking
- Remove access immediately when employees leave -- Do not leave stale accounts active
- Enable two-factor authentication for all users -- Add an extra layer of security
- Use unique email addresses -- No shared accounts
Next steps
- Settings -- Configure your account preferences
- Notifications -- Set up notification preferences for your team