Team members and roles

A RenderScreenshot account can have several people. They share one plan, one credit balance, one set of API keys and one request log. The Team page in the dashboard is where you invite people and choose what each person may change. This page describes the roles and the invitation flow, and explains how to remove a member without breaking an integration. It is part of the documentation.

Roles

The person who created the account is the owner. There is one owner. Nobody can invite another owner or promote anyone to owner, and the owner's role cannot be changed or removed from the Team page. Admins can invite people and change roles only between Member and Admin.

Owners and admins see every workspace. A member sees only the workspaces they are added to, and the API keys, logs and usage of those workspaces.

Give Admin to people who run the integration: they rotate keys, set up webhooks and storage, and manage the team. Give Member to people who need to look at usage and logs or test in the playground. Members cannot manage API keys, billing, webhooks, storage or account settings.

Invite someone

1. Open Team in the dashboard.
2. Under Invite Team Member, enter the email address and choose Member or Admin.
3. For a member, check the workspaces they may open. With none checked, they join the Default workspace.
4. Select Send Invite.

The person receives an email with an Accept Invitation link. The invitation:

• expires after 7 days,
• can be sent only once per email address while it is pending,
• is refused if the address already belongs to a member of your team,
• can be withdrawn with Cancel under Pending Invitations, which also shows who sent it and when it expires.

Accept an invitation

Someone without an account opens the link, sets a name and a password, and lands in your team's dashboard.

Someone who is already signed in sees one Accept Invitation button. Read this before you select it:

• A login belongs to one account. Accepting moves your login to the new team, with the role in the invitation.
• You lose access to your previous account from that login.
• If you are the only owner of your current account, you cannot accept: the account would be left with no owner. The page says so instead of showing the button. Contact [email protected] to transfer or close that account first.

To stay in both teams, sign out and accept with a different email address.

Change a role or remove a member

Owners and admins see a role menu and a Remove button next to each member. Two limits apply: you cannot change your own role or remove yourself, and nobody can change or remove the owner. A role change applies on the member's next page load.

Remove a member without breaking an integration

API keys belong to the account, not to the person who created them. Removing a member deletes their login only. Every key they created stays active, keeps working and keeps its request history in the request logs. After the removal, the API Keys page still lists those keys. Pending invitations that the member sent also stay valid.

A departing member may still have a copy of a key they created or used. To close that access without breaking an integration, rotate those keys:

1. On API Keys, note the keys the departing member could see and their Last Used times.
2. An admin or the owner creates replacement keys and deploys them, as in key rotation.
3. When the old keys show no new use, revoke them.
4. Remove the member on the Team page. You can also remove the member first: removal does not revoke or delete any key.

If a service still holds a revoked key, its requests fail with HTTP 401:

{
  "error": {
    "type": "authentication_error",
    "code": "missing_credentials",
    "message": "No valid API key or signature provided",
    "retryable": false,
    "docs": "https://renderscreenshot.com/docs/errors/missing-credentials"
  },
  "request_id": "9d27c5e1-48af-4b3e-a61c-f0e2b8d4c793"
}

Run a key check in each service's deploy pipeline so a dead key fails the deploy, not production traffic. GET /v1/presets needs a valid key but renders nothing, so the check uses no credits. It does count toward the per-minute rate limit.

#!/usr/bin/env bash
# Exit non-zero if RS_API_KEY no longer authenticates. GET /v1/presets uses no credits.
status=$(curl -sS -o /dev/null -w '%{http_code}' \
  -H "Authorization: Bearer $RS_API_KEY" \
  https://api.renderscreenshot.com/v1/presets)
if [ "$status" != "200" ]; then
  echo "RenderScreenshot key check failed: HTTP $status" >&2
  exit 1
fi
echo "RenderScreenshot key OK"

Tested on 2026-10-15 with bash and curl against a local stub of the API: exit code 0 for a valid key, 1 with HTTP 401 for an unknown one.

Good practice for shared accounts

• Give each production service its own key, created by an admin who will stay on the team, and name the key after the service.
• Review the member list when someone changes role or leaves the company. Removing a person from your identity provider does not remove them from RenderScreenshot.
• Use the request logs to see which key made which request. Each log entry shows the key, masked.

More on key handling: API keys and security best practices.

Last verified 2026-10-18 against the dashboard's team, invitation, API key, billing, webhook, storage and settings code.