Team access
Not everyone on the sales team should hold the workspace API key. Klozeo seats let you invite colleagues to the dashboard with a clear role, while n8n, SDKs, and scripts keep working exactly as before.
| Role | Dashboard & API | Typical use |
|---|---|---|
| Owner | Full access, including API key management | Founder / admin who owns the workspace |
| Editor | Can create, update, and delete leads and related data | Ops, SDRs, enrichment workflows via the UI |
| Viewer | Read-only — any mutation returns 403 | Managers who need visibility without write access |
API key endpoints (GET/POST/DELETE /api-keys) are owner-only. An invited editor or viewer receives:
{ "error": "forbidden", "message": "Only the workspace owner can perform this action", "code": "forbidden"}A viewer calling any mutating method (POST, PUT, DELETE, …) receives:
{ "error": "forbidden", "message": "Viewer role cannot modify data", "code": "forbidden"}How the API sees the role
Section titled “How the API sees the role”The Next.js dashboard proxy forwards two headers when an invited member acts on the owner’s workspace:
| Header | Meaning |
|---|---|
X-Member-Role | owner, editor, or viewer |
X-Actor-Id | User id of the person performing the action (written into the audit trail) |
If X-Member-Role is missing or unrecognized, the API treats the caller as owner.
Direct API keys stay owner (backward compatible)
Section titled “Direct API keys stay owner (backward compatible)”n8n, the SDKs, cURL, and any client that authenticates with X-API-Key alone do not send X-Member-Role / X-Actor-Id. Those callers are treated as the workspace owner.
Existing automations do not break when you invite team members. Seats constrain dashboard (proxy) access; they do not downgrade script or workflow keys.
What to share with your team
Section titled “What to share with your team”- Editors / viewers — invite them from the dashboard; they sign in and work in the UI.
- Automations — keep using the owner’s API key (or create keys as the owner). Do not put member session cookies into n8n.
- Audit — when a member mutates a lead through the proxy,
actor_idonGET /leads/{id}/changesshows who did it.