---
title: Members & roles
description: Owner, admin and member roles and what each can do, invitations, personal settings, 2FA, push notifications, installing the app, API keys, OAuth consent and multiple organizations.
canonical: https://watchfor.io/docs/organization
---

# Members & roles

Owner, admin and member roles and what each can do, invitations, personal settings, 2FA, push notifications, installing the app, API keys, OAuth consent and multiple organizations.

Everything in WatchFor lives inside an **organization** — your monitors, alert rules, channels, incidents, status pages,
API keys and billing. People join an organization with a **role** that
controls what they can do. Organization settings live under **Settings** in
the sidebar (General, Members, Notifications, API keys, Activity log,
Subscription); your personal settings are under your avatar → **Settings**.

## Roles

	- [Owner](#): Full control. Everything an admin can do, plus deleting the organization. Usually the person who created it.
	- [Admin](#): Runs the organization day to day: monitors, alert rules, channels and contacts, status pages, maintenance, on-call, billing, members, API keys, report emails, the activity log.
	- [Member](#): Works incidents: sees everything, acknowledges, writes internal notes and post-mortems, takes on-call shifts — without changing monitors, alerting setup, status pages or organization settings.

What each role can do today:

| Action | Owner | Admin | Member |
| --- | --- | --- | --- |
| View monitors, incidents, dashboards, reports, alert rules, channels, contacts, contact groups and status pages | ✓ | ✓ | ✓ |
| Acknowledge incidents, write [internal notes](/docs/alerting/internal-notes) | ✓ | ✓ | ✓ |
| Write [post-mortems](/docs/alerting/postmortems) | ✓ | ✓ | ✓ |
| Send a test notification to a channel or through a monitor's route | ✓ | ✓ | — |
| Organization notification preferences and settings | ✓ | ✓ | — |
| Create, edit, pause, resume, delete monitors; run a check now; mute alerts; import from other tools | ✓ | ✓ | — |
| Manage [alert rules](/docs/alerting), [notification channels](/docs/notifications), [contacts and contact groups](/docs/notifications/contact-groups) | ✓ | ✓ | — |
| Create, edit and delete [status pages](/docs/status-pages), their components and announcements | ✓ | ✓ | — |
| [Resolve incidents manually](/docs/alerting/resolving#manual-resolve), mark as maintenance | ✓ | ✓ | — |
| Publish or delete post-mortems | ✓ | ✓ | — |
| [Maintenance windows](/docs/monitors/maintenance), [on-call schedules and escalation policies](/docs/alerting/on-call) | ✓ | ✓ | — |
| [Report email](/docs/reports) cadences and recipients | ✓ | ✓ | — |
| Invite and remove members, change roles | ✓ | ✓ | — |
| Billing: change plan, invoices, payment method | ✓ | ✓ | — |
| API keys (create, rename, revoke — members don't see the list) | ✓ | ✓ | — |
| View the [activity log](/docs/organization/activity-log) | ✓ | ✓ | — |
| Delete the organization | ✓ | — | — |

Members are not left guessing: an action they may not take is **shown but
disabled**, with an *Owners and admins only* tooltip — organization name and
branding, notification preferences, New monitor and Import, new
maintenance windows and on-call schedules. Two things are hidden rather than
disabled, because there is nothing useful behind them: **Settings → API
keys** (a member opening `?tab=api-keys` lands on General) and **Settings →
Activity log**, which shows an *Owners and admins only* notice if a member
follows a direct link. Acknowledging incidents, writing internal notes and
drafting post-mortems stay open to members — that is the point of the role.

## Inviting people

Invite teammates from **Settings → Members** by email and pick their role.
The invitee gets an email; accepting it creates their membership (and their
account, if they're new). Pending invitations count toward your plan's
**member limit** together with current members, so you're told before you
run out of seats — the limit depends on your plan (see [pricing](/pricing));
there are no per-seat fees.

An invitation that never arrived can be **re-sent** from the **⋯** menu on
its row in *Pending invitations* — the same link goes out again and the
activity log records the resend. Revoking an invitation, removing a member
and leaving an organization all ask you to confirm first, naming the person
or the email address, because each one takes access away immediately.

Roles can be changed later from the same page. Granting **Owner** asks you
to confirm first, naming the person, because an owner controls billing,
deleting the organization and every member's role. Only owners can make
someone an owner or change another owner's role; admins manage admins and
members.

**Leaving an organization.** Any member can leave from their own row in
**Settings → Members** (**⋯ → Leave organization**). Access ends
immediately, and getting back in takes a new invitation. The only owner
can't leave — make someone else an owner first; if you're the only member,
delete the organization instead.

Every invitation, re-sent invitation, revoked invitation, join, role change
(attributed to the person who made it), removal and departure is written to
the [activity log](/docs/organization/activity-log).

## Switching organizations

People can belong to **any number of organizations** and switch between them
from the organization picker. The picker shows each organization's health at
a glance — monitor count and any firing incidents — so you can jump to the
one that needs you. If you belong to only one, you land straight in it.

**Deep links work from a cold start.** A link in an alert email, a Slack
message or a bookmark — an incident, a monitor, a filtered list — opens the
page it points to right after you sign in, without a detour through the
dashboard home; the organization is picked for you when the link belongs to
your only organization or the one you used last. A link to something that no
longer exists (or that you are not a member of) gives one consistent screen
inside the dashboard: *This monitor doesn't exist or you don't have access*,
with a way back — never a blank page or a silent redirect.

## Multiple organizations

Every account includes **one free organization** — normally the one created at
sign-up. You can create more (one per client, per company, per environment),
and each additional organization needs **its own plan**:

- A new extra organization starts **locked** — it can't run monitors or use the
  toolbox until a plan is chosen in its **Settings → Subscription** (a coupon
  code works too). You can also delete it from there if you created it by
  mistake.
- Your existing free organization is never affected — you don't have to upgrade
  it to add a paid organization next to it.
- Memberships don't count: you can be invited into any number of other
  organizations regardless of what you own.
- If your free allowance is no longer in use (you deleted or upgraded that
  organization), a locked organization offers **"Use my free organization allowance
  here"** and becomes your free one.

You can own up to 10 organizations; if you genuinely need more,
[contact us](/contact).

## Personal settings

Under your avatar → **Settings**, in three tabs (on a phone, a list you tap
into):

- **Profile** — name, avatar, email, and your **timezone and time format
  (12-hour or 24-hour)**. Every time shown in the dashboard — check results,
  incident timelines, the activity log — follows these preferences.
  **Delete account** is here too: it removes your user account. Hand
  organizations you own to another owner (change their role to owner) or
  delete them first.
- **Security** — change your password (or set one if you signed up with
  Google), turn on **two-factor authentication** with an authenticator app
  (TOTP), and manage connected sign-in providers and connected apps.
- **Sessions** — this device first, then your other sessions grouped by
  device and browser. Sign out one session, a whole group, or everything
  else at once with **Sign out all other sessions**.

Sign-in options are email + password and **Google**. Two-factor
authentication is per user and is enforced on every sign-in once enabled.

## Inbox and in-app notifications

The bell in the top bar and the **Inbox** page (sidebar → Inbox) hold your
in-app notifications for the active organization: incidents opening,
being acknowledged and resolving, what's new in WatchFor, service notices,
and — as they are rolled out — maintenance and report events.

- **Bell** — the eight most recent notifications. Clicking one marks it read
  and opens it in the Inbox, where the full text is readable and an **Open**
  button leads to what it is about (the changelog entry, an incident…).
  **Mark all read** and **Clear all** act on your whole inbox, not just the
  eight shown; **Clear all** asks you to confirm first, in the bell and on the
  Inbox page alike. Tab reaches every notification; <kbd>↵</kbd> opens it.
- **Inbox** — a list on the left, the full message on the right. Incident
  rows are badged by severity — red **Down** for critical, amber
  **Degraded** for warning — and say how an incident ended: *Recovered
  after 12m* for an automatic recovery, *Resolved manually by …* when a
  person closed it. The monitor's target is on its own line, and a
  heartbeat monitor shows its name there rather than its ping URL. Filter by
  Unread or category, search, and use the keyboard: <kbd>j</kbd>/<kbd>k</kbd>
  move, <kbd>↵</kbd> opens the target, <kbd>u</kbd> toggles unread,
  <kbd>e</kbd> dismisses. The filter and the search stay in the address
  (`?filter=unread&q=…`), so a reload, Back and Forward keep them. Every
  notification has a link you can share with a teammate (`?n=…`). The full list of dashboard shortcuts is in
  [Keyboard shortcuts](/docs/reference/keyboard-shortcuts).
- **Read and dismissed are yours alone.** Marking something read or clearing
  your inbox never changes what other members see.
- **Preferences** — **Settings → Notifications → In-app notifications** lets
  each member choose which kinds land in their bell and Inbox (incidents,
  maintenance windows, reports, what's new, system messages). A switch
  applies immediately, also to what was posted earlier, and switching it back
  on brings those back. Alert channels (email, Slack, PagerDuty…) are
  separate — see [Notifications](/docs/notifications).

### Push notifications

Push puts incidents on your phone or desktop even when WatchFor isn't open.
It is personal and **per device**: each member turns it on for each browser
or installed app they want it on.

- **Turn it on** under **Settings → Notifications → Push notifications** →
  **This device**, and allow notifications when the browser asks. **Send
  test push** checks the device end to end. **Other devices** lists your other
  browsers and installed apps with push on, with when a push last reached
  each, and lets you remove any of them.
- **iPhone and iPad** (iOS and iPadOS 16.4 or later) deliver push only to the
  installed app: [install WatchFor](#install-the-app) (**Share → Add to Home
  Screen**), open it from the Home Screen, and turn push on there. Android,
  Chrome, Edge, Firefox and Safari on the Mac work straight from the browser.
- **Brave** keeps web push off by default: open Settings → Privacy and
  security, turn on **Use Google services for push messaging**, restart
  Brave, then turn push on. WatchFor says so if you try without it.
- **What pushes**, per organization: *Incident opened* (on by default — a
  confirmed Down or Degraded incident), *Incident resolved* (on — it replaces
  the open-incident notification) and *Acknowledged by someone* (off — when a
  member of the organization takes the incident).
- **Acknowledge from the notification.** On Android and desktop Chrome or
  Edge an opened-incident notification has an **Acknowledge** button: it
  acknowledges as you, without opening the app, and the
  [activity log](/docs/organization/activity-log) records it like an
  acknowledgement made in the dashboard. The button stays valid for 12
  hours; after that, or where the browser has no action buttons (Safari,
  Firefox), tapping the notification opens the incident instead.
- **Tapping a notification** opens the incident and switches to its
  organization first, so a push from another organization you belong to
  lands on the right page.
- **The Inbox switch wins.** Turning **Incidents** off under In-app
  notifications silences incident pushes for that organization too.
- Push is separate from alert channels and on-call paging — it never
  replaces the [notification channels](/docs/notifications) your team relies
  on for alerts.

## Install the app

WatchFor installs as an app straight from the browser — there's no App Store
or Google Play app to download. The installed app opens the dashboard in its
own window, without the browser's address bar. It is the same dashboard and
needs a connection; offline it shows a short notice and reloads once you're
back online. On iPhone and iPad the installed app has its own sign-in, so
sign in once after installing. Screenshots of the phone and desktop app are
on [WatchFor on mobile](/mobile); a [native Android app](/mobile-app) is
being tested.

- **Android — Chrome, Edge or Samsung Internet:** tap **Install app** on the
  dashboard card or in your avatar menu, then **Install**. The browser's
  own menu has it too (**⋮ → Add to Home screen** or **Install app**).
- **iPhone and iPad:** open WatchFor in Safari, tap **Share** (in the
  toolbar or behind **···**), choose **Add to Home Screen**, then **Add**.
  Chrome and Edge on iOS 16.4 or later have the same option under Share.
  Incident [push notifications](#push-notifications) on iPhone and iPad work
  only from the installed app.
- **Firefox for Android:** open the **⋮** menu and choose **Install** (on
  some versions **Add to Home screen**).
- **Desktop Chrome or Edge:** click the install icon at the right end of the
  address bar, or **Install app** in your avatar menu.
- **Safari on the Mac** (macOS Sonoma or later): **File → Add to Dock**.

From the second visit, phones show a small **Install WatchFor** card on the
dashboard; **×** hides it for 30 days. **Install app** in your avatar menu
is there whenever this browser can install and WatchFor isn't installed
yet.

## API keys

Owners and admins create API keys under **Settings → API keys** for scripts,
CI, the SDKs and CLI, and MCP clients configured by hand:

- Keys look like `wf_live_…`, belong to exactly one organization, and are
  shown **once** at creation (they're stored hashed).
- Each key has a fixed **scope** — `read` (every GET endpoint and read-only
  tools) or `write` (read plus create, update, delete, acknowledge, resolve)
  — and an optional **expiry**, as a number of days or an exact date and
  time.
- Keys can be **renamed** later; the name is what the activity log shows.
- An organization can hold up to **20 active keys**; revoke unused ones.
  Revocation is instant, and the dashboard shows each key's last use.
- Creation, renaming and revocation are logged, and everything a key does is
  attributed to it in the activity log as `API key: <name>`.

Full details: [API authentication](/docs/api/authentication).

## Connecting AI agents (OAuth 2.1)

MCP clients that support the MCP authorization flow (Claude, Cursor and
others) don't need a hand-made key. When such a client connects to
`https://watchfor.io/api/mcp`, WatchFor opens a **consent screen** in your
browser where you sign in, pick the organization and approve the scopes the
client asked for (`read`, `write`). The client then receives short-lived
access tokens (with refresh) that act with your membership's permissions.
See [OAuth 2.1](/docs/api/authentication#oauth-21) and the
[MCP server](/docs/api/mcp) pages.

## Deleting an organization

Owners can delete an organization from **Settings → General → Danger Zone**.
This is irreversible: monitors are removed from the checking fleet, and the
organization's data — monitors, incidents,
alert rules, channels, status pages (their public URLs stop resolving),
maintenance windows, on-call schedules, post-mortems, API keys and activity
log — is deleted. Cancel an active subscription and download any invoices
you need before deleting.

## Multi-tenant by design

Each organization's data is fully isolated. Monitors, incidents and settings
are always scoped to the organization you're working in, and an API key or
OAuth token can only ever see the organization it was issued for.

> **Also via API**
>
> `GET /v1/me` tells you which organization and scope a key or token has;
> `GET /v1/plan` returns the organization's plan and limits — see
> [Plan & usage](/docs/api/plan).

---

Canonical page: https://watchfor.io/docs/organization · All docs: https://watchfor.io/docs · Site guide: https://watchfor.io/llms.txt