# Roles \[What each role and API key scope can do]

Every team [member](/members) has exactly one of two roles: **Owner** or **Member**. Roles are stored offchain, govern what a person can see and do in the app, and are scoped to one team: the same person can be an Owner of one team and a Member of another. A role never grants signing authority: approving transactions belongs to an account's onchain signer set, and the boundary is drawn at [Signers](/accounts/signers#signers-vs-membership).

A related surface (**API key scopes**) governs what programmatic clients can do; see [below](#api-key-scopes).

## What each role can do

| Capability | Owner | Member |
| --- | --- | --- |
| View accounts, balances, and transactions | ✅ | ✅ |
| Propose transactions from an account | ✅ any account | Only accounts they're a signer on |
| Sign transactions | Only if a signer on that account | Only if a signer on that account |
| Reject pending transactions | ✅ | Only if a signer on that account |
| Create new accounts | ✅ | ❌ |
| Edit account settings (name, signers, threshold) | ✅ | ❌ |
| Invite, remove, and change roles of members | ✅ | ❌ |
| Edit team name and logo | ✅ | ❌ |
| Toggle [*Require memos*](/transactions/memos#requiring-memos) | ✅ | ❌ |
| Create invoices | ✅ | ❌ |
| Create and manage automations and schedules | ✅ | ❌ |
| Onramp / offramp | ✅ | ❌ |
| Entity verification (KYB/KYC) and payment info | ✅ | ❌ |
| Manage recovery | ✅ | ❌ |

## Read-only members

A member with the **Member** role whose signing keys aren't signers on any account is effectively read-only: they can see the team's accounts, balances, and transactions, but can't propose or sign any. (Owners can propose from any account, so read-only requires the Member role.)

To set one up, [invite them](/members#inviting) with the Member role and don't add them to any account's signer set. Useful for accountants, auditors, and anyone who needs visibility without the ability to move funds.

## Settings visibility by role

| Settings section | Owners | Members |
| --- | --- | --- |
| General | ✅ | ✅ |
| Members | ✅ | ✅ |
| API Keys | ✅ | ✅ |
| Networks | ✅ | ❌ |
| Recovery | ✅ | ❌ |
| Tokens | ✅ | ❌ |
| Banks | ✅ | ❌ |

## API key scopes

API keys power the [CLI and MCP](/introduction/agents). Each key is scoped at creation:

| Scope | Grants | Who can create a key with it |
| --- | --- | --- |
| `read` | List accounts, transactions, balances, and other team data | Any member |
| `write` | Read, plus propose transactions and update memos/properties | Any member |
| `owner` | Admin operations (manage accounts and org settings) | Owners only |

Like roles, API key scopes never grant onchain signing authority by themselves: signing programmatically requires a [registered EOA signer](/introduction/agents#sign-locally-with-an-eoa) on the account.