Members and invitations

The Members screen shows everyone with access to the current organization. Administrators and owners can invite people, retry or cancel pending invitations, and remove eligible members. A pending invitation counts toward the workspace member limit until it is accepted, cancelled, or expires 7 days after it is sent. An expired invitation does not hold a seat. To free a seat sooner, cancel a pending invitation that you no longer need.

Built-in roles have important guardrails. An administrator cannot remove themself or another administrator, and cannot remove an owner. Only an owner can change a non-owner member's built-in role or assign a custom role. Ownership is not a normal role edit. When responsibility must move to another person, use the owner-transfer flow in Organization settings.

Before you remove access, reroute any Inbox work that belongs to the person. Rotate any credentials that the person knew. Check whether the person holds a custom role. Send invites only to the intended email address. Follow each invite through its pending state. Do not treat a pending invite as membership.

Owners and administrators see a 2FA column in the members list. It shows On for a member who has set up two-factor authentication and Off for one who has not. While the organization requires it, an owner or administrator without it shows Due with a date during the grace period, and Overdue once that period has passed. An owner can select Reset 2FA for a member who has lost their second factor. The reset removes the member's authenticator app, backup codes and passkeys, signs them out everywhere, and emails them. Confirm that the request really comes from that person first. An owner cannot reset their own account, a co-owner, or someone who is an owner or administrator of another organization. Those accounts go to support.

This page controls dashboard access only. API key access is separate. When an integration owner leaves, revoke their API keys from the API keys section.