Control who can access your workspace and what they can do. This guide covers roles, two-factor authentication, sensitive attributes and the audit log, so you can give teammates the access they need.
Roles
Every workspace has three roles. A person can have a different role in each workspace they belong to.
| Role | What they can do |
|---|---|
| Owner | Everything, including inviting and removing people, changing roles, exporting contacts, creating full-access API keys, connecting payment providers, and deleting the workspace. Each workspace has one owner. |
| Admin | Set up sending, import contacts and review AI agent work. Admins can’t manage people or export contacts. |
| Member | Create and send campaigns, journeys, segments and forms. No workspace setup. |
To invite people and set their roles, see Invite your team. Change a role or remove someone from Settings › Workspace › People. Someone you remove loses access at once and is signed out everywhere.
Hand over ownership
To make someone else the owner, open their row’s menu on People and choose Make owner…. You’ll confirm your password, and your two-factor code if you use one. You become an admin.
Workspace rules
On People, the owner can turn on two Workspace rules:
- Only admins and owners can send. Members can still write and edit campaigns and journeys, but only an admin or owner can send, schedule or unschedule a campaign, or activate or pause a journey. Use this when you want a second pair of eyes on everything that goes out.
- Require two-factor sign-in. Anyone without two-factor sign-in is taken to set it up before they can do anything else. Turn it on for yourself first.
Two-factor sign-in
Two-factor sign-in asks for a code from an authenticator app, such as Google Authenticator or 1Password, as well as your password.
- Go to Settings › Account › Two-factor sign-in.
- Scan the QR code with your authenticator app and enter the code it shows.
- Save your recovery codes somewhere safe. If you lose your phone, you can sign in with Use a recovery code.
Where you’re signed in
Settings › Account › Where you’re signed in lists your active sessions, so you can sign out of a device you no longer use. Changing your password from Settings › Account › Password signs you out everywhere.
Hide sensitive attributes from members
If some contact attributes are sensitive, such as date of birth, the owner can hide them from members in Settings › Workspace › People under Hidden attributes. Members see the value as Hidden, can’t use it in conditions, and see the merge tag’s fallback in their previews and test sends. Real sends still use the true value.
Audit log
Admins and owners can open Settings › Workspace › Audit log to see who sent, changed, exported or signed in, with filters and a CSV export.
Integrations and AI agents
- Only admins and owners can see Integrations, and only the owner can connect a payment provider.
- AI assistants connect with a restricted agent key that can never send, activate a journey or change contacts. See Use Kiro AI with Claude or Cursor.
API keys
API keys let your website, app or other tools work with your workspace. They’re created in Developer › API keys, each with only the permissions it needs, and the full key is shown only once. Owners can create full-access keys. For the details, point your developer to Authentication.
Learn more
Read about how Kirora protects your data on our Security page.