Drıftstack docs
Docs

‘Your team role is read-only’ (keys, recipes, profiles need admin)

You might be here because: “Your team role is read-only for the selected account” · “Ask a team admin to create, rotate, or revoke keys” · “API key writes on a team owner require admin role on that team” · “Profile writes on a team owner require admin role on that team” · “Recipes in a team owner’s workspace require the admin role” · “can’t edit anything in my team’s workspace” · “buttons are missing when acting as the owner” · “403 forbidden on the team account” · “how do I become admin”

Short answer

In a team owner’s workspace a member can look but not change: creating, rotating or revoking API keys, writing profiles, and every recipe action need the admin role. Ask the owner or an admin to make the change, or ask the owner for the admin role. Your own account is unaffected — switch Acting as back to it to change your own things.

Check first

  • Which workspace is selected? “for the selected account” means the picker is on a team, not on you.
  • Which role? The owner set it when inviting: member reads, admin reads and writes.
  • A 403 can also be your own key lacking a scope: the role decides whose resources you reach, your key’s scopes what it may do there.

Likely causes and fixes

  1. Keys page: “Your team role is read-only for the selected account. Ask a team admin to create, rotate, or revoke keys.” A member is not shown the owner’s key list (listing needs admin): the list reads “Only a team admin can see this account’s API keys.”; create, rotate and revoke are hidden. Even an admin cannot give a new key full access or admin permissions — only the owner can.

  2. API 403 “API key writes on a team owner require admin role on that team.” Listing the owner’s keys needs the admin role too (a member gets 403 “Listing API keys on a team owner requires admin role on that team.”); creating, revoking and rotating are admin-only, and the key is minted on the owner’s account.

  3. 403 “Profile writes on a team owner require admin role on that team.” Members can list the owner’s profiles but not create, edit or delete them.

  4. 403 “Recipes in a team owner’s workspace require the admin role.” Every recipe route, reads included, because a recipe is a saved copy of an agent session’s steps.

  5. “We couldn’t confirm your permission to change keys for the selected account, so the list is read-only for now.” A transient check, not your role. Fix: check which account is selected, then reload.

  6. Becoming admin. Only the owner invites, and sets the role then; the owner is always implicitly admin. There is no switch to change a role later: the owner sends you a new invite with the other role, and your role changes when you accept it.

If it still fails

If the owner’s Team page shows you as admin and you still get a read-only message, press Talk to a person in this chat (or open Help) and include: the owner’s account email, your email, the workspace selected, and the exact sentence and page.