Skip to content

Members & Roles

Appliku uses a role-based access control system with three permission levels. Team members are invited by email and accept via a token-based flow.

Permission Roles

Role Description Permissions
Owner Full control over the team All actions, including billing management, team deletion, and member role changes
Admin Manage infrastructure and settings Add/remove servers, manage applications, configure team settings, invite members
Developer Day-to-day application management Create and manage applications, deploy, view logs, manage environment variables

Roles are hierarchical -- each role includes all permissions of the roles below it:

Owner  >  Admin  >  Developer

Permission Details

Action Owner Admin Developer
Deploy applications Yes Yes Yes
Create/edit applications Yes Yes Yes
Manage environment variables Yes Yes Yes
View logs Yes Yes Yes
Add/remove servers Yes Yes No
Manage databases Yes Yes No
Create clusters Yes Yes No
Invite/remove members Yes Yes No
Change member roles Yes No No
View or manage billing Yes No No
Delete team Yes No No

These permissions apply to the Appliku dashboard and API. They do not limit what a member can do on the servers. See Server Access.

Server Access

All team members can get root-level access to team servers

Appliku adds the SSH keys of every team member (Owner, Admin and Developer) for the app user on all servers of the team. The app user is in the docker group, and Docker access is equal to root access on that server. This includes the environment variables and database data of the applications on that server. On a cluster manager node, it also includes cluster secrets and the environment variables of all cluster services. Developers can also run commands on the server through application settings. Owners and Admins also get keys for the root or sudo user (ubuntu on AWS).

The Developer role does not protect your servers. Only invite people you trust with your servers.

When you remove a member, Appliku removes their keys from the active servers of the team. This does not close SSH sessions that are already open. A server that is not active, or that Appliku cannot reach at that time, can keep the old keys. Appliku does not try again later and does not show this. A person with root-level access can also add other ways to get in. If you remove a person you do not trust, check the authorized_keys files of the app user and of the root or sudo user on your servers, and change secrets (for example, environment variables, database passwords and cluster join tokens) as necessary. If you cannot be sure that a server is clean, replace it. Deleting a team does not remove member keys from its servers.

Inviting Members

  1. Go to your team settings in the Appliku dashboard
  2. Navigate to the Members section
  3. Click Invite Member
  4. Enter the person's email address
  5. Select the role to assign
  6. Click Send Invite

The invited person receives an email with an invitation link containing a unique token. They must click the link to accept the invitation.

Note

If the invited person does not have an Appliku account, they will be prompted to sign up before accepting the invitation.

Managing Members

From the team Members section, you can:

  • View all current members and their roles
  • Change roles -- Owners can change any member's role
  • Remove members -- Owners and Admins can remove members from the team

Best Practices

  • Limit Owner access -- Only the account holder and trusted administrators should have the Owner role
  • Use Developer for deployments -- Team members who only need to deploy and manage applications should be Developers
  • Use Admin for infrastructure -- Team members who need to provision servers or manage databases should be Admins
  • Invite only trusted people -- All roles can get root-level access to team servers (see Server Access)

Next Steps