Team roles: who can do what

Short answer

Everyone on your team has one role, and the role decides what they can see and do. Give each person the smallest role that fits their work.

View as Markdown

Verified 1 November 2026

In this article

Choosing a role
Everything each role can do
If you cannot see a button or page
Actions that ask for your code again
Who can change a role

Choosing a role

Role	Good for
Owner	The one person answerable for the business. There is exactly one.
Administrator	Someone who runs the business day to day, including the team and payouts.
Developer	Someone building on your account, with API keys and webhooks. They cannot refund or invite people.
Analyst	A bookkeeper or accountant. They read payments, customers and the balance, can download reports, and change nothing.
Support	Front desk or customer service. They can refund and answer disputes, and cannot see your balance or payouts.
Viewer	Someone who only needs to look things up, and changes nothing.

Everything each role can do

Permission	Owner	Administrator	Developer	Analyst	Support	Viewer
View payments, refunds, disputes and reviews `payments:read`	✓	✓	✓	✓	✓	✓
Refund payments `payments:refund`	✓	✓	—	—	✓	—
Capture authorised payments `payments:capture`	✓	✓	—	—	✓	—
View customers `customers:read`	✓	✓	✓	✓	✓	✓
Create and edit customers and saved cards `customers:write`	✓	✓	✓	—	✓	—
Create and edit products and prices `products:write`	✓	✓	✓	—	—	—
Create and edit payment links `payment_links:write`	✓	✓	✓	—	—	—
Change the payout schedule and request payouts `payouts:manage`	✓	✓	—	—	—	—
Create, send and void invoices; manage tax rates `invoices:write`	✓	✓	✓	—	✓	—
Write risk rules and lists; approve flagged payments `risk:manage`	✓	✓	—	—	—	—
Create, roll and revoke test API keys `keys:test`	✓	✓	✓	—	—	—
Create, roll and revoke live API keys `keys:live`	✓	✓	✓	—	—	—
View and manage webhook endpoints `webhooks:manage`	✓	✓	✓	—	—	—
View events `events:read`	✓	✓	✓	✓	—	✓
Download reports and exports `exports:read`	✓	✓	✓	✓	—	—
View the team `team:read`	✓	✓	✓	✓	✓	✓
Invite people `team:invite`	✓	✓	—	—	—	—
Change roles and remove people `team:manage`	✓	✓	—	—	—	—
Edit business settings `settings:business`	✓	✓	—	—	—	—
Edit security settings `settings:security`	✓	✓	—	—	—	—
Fill in the activation application and its documents `activation:manage`	✓	✓	—	—	—	—
Transfer ownership `account:transfer`	✓	—	—	—	—	—
Close the business `account:close`	✓	—	—	—	—	—
Answer and accept disputes `disputes:manage`	✓	✓	—	—	✓	—
Create and cancel payments and checkout sessions `payments:write`	✓	✓	✓	—	✓	—
View the balance, payouts and balance reports `balance:read`	✓	✓	✓	✓	—	✓
View connected accounts (in live mode, platforms only) `connect:read`	✓	✓	✓	✓	—	—
Create connected accounts and send onboarding links (in live mode, platforms only) `connect:write`	✓	✓	✓	—	—	—
Give an application fee back to a connected account (in live mode, platforms only) `application_fees:refund`	✓	✓	—	—	✓	—
Create Sandboxes `sandboxes:create`	✓	✓	✓	—	—	—
Use test helpers, such as making a test payout fail (test mode only) `test_helpers:write`	✓	✓	✓	—	—	—
Change and delete any Sandbox `sandboxes:manage`	✓	✓	—	—	—	—
Choose your own notifications and read your inbox `notifications:self`	✓	✓	✓	✓	✓	✓

If you cannot see a button or page

The dashboard hides what your role cannot do. Ask your business’s owner or an administrator to change your role in Settings → Team.

Actions that ask for your code again

Some actions need a code from your authenticator app from the last ten minutes, even when you are signed in. These include changing payouts and inviting or managing your team. Refunds do not ask.

Who can change a role

An owner can change anyone’s role except their own.
An administrator can change anyone except the owner and other administrators.
A person who is removed loses access on their very next click, because we check on every request.