--- title: "Your team, roles and logs" description: "Give each person their own login and a fixed or custom role, limit what each API key can do, and see who changed what in the audit log and the request log." canonical_url: "https://twominutebilling.com/help/guides/your-team" --- # Your team, roles and logs > Give each person their own login and a fixed or custom role, limit what each API key can do, and see who changed what in the audit log and the request log. Each person on your team signs in with their own login and a role that matches their job. The audit log then records who changed what and when, in the dashboard or through the API, and the request log shows each API request and what we answered. ## Invite your team Open **Team** and select **Invite member**. Give everyone their own login rather than sharing one — a shared account makes the audit log useless, and removing one person means changing a password for everybody. Roles let you give someone what their job needs and nothing more. Support does not need to change your pricing. Whoever chases payments does not need to add team members. Remove access the day someone leaves. Their history stays in the audit log. ## Roles **Team → Roles** lists every role and how many permissions it has. A permission is one action on one kind of record, such as viewing invoices or managing the catalogue. There are five fixed roles, which you cannot change: **Owner**, **Admin**, **Manager**, **Ops** and **Developer**. Select **View permissions** on one to see what it holds. ## Create a custom role When no fixed role fits, make your own. ### Open the role editor In **Team → Roles**, select **Create role**. ### Name it Give it a **Name** and, if you like, a **Description** of who it is for. ### Select the permissions **Start from** fills in the permissions of a fixed role, as a starting point. Then select or clear permissions, grouped by area. You cannot give a permission that you do not have yourself, so those are disabled. ### Give it to people Select the role when you invite someone, or change a member's role in the **Members** list. A change to a role applies to each member with it on their next request. You cannot edit or delete the role you hold yourself, and you can delete a custom role only when no member has it. Nobody can change their own role, so another owner or admin must do it. A change that would leave no owner, or no owner or admin at all, is refused. When someone's role changes, they get an email. ## API keys API keys live under **Developers → API keys**. When you create a key, select:
Field What it decides
Mode test or live . A key works in one mode only.
Expiry Never expires , or 30 days, 90 days or 1 year. An expired key gets 401 .
Access Full access , Read only , or Custom: select access per resource . Custom sets each resource to No access , Read or Read and write .
Give each integration the least access it needs. A key that only reads invoices into your accounting tool needs no write access at all. As with roles, you cannot give a key more than you have yourself. Change it later with **Edit access**; the change applies to the key's next request. The full secret shows once, when you create or rotate the key. **Rotate** creates a new key with the same name, mode and access, and **The old key stops** sets when the old one stops: **Immediately**, after 1 hour, after 24 hours or after 7 days. The overlap gives you time to deploy the new key. **Revoke** stops a key at once. The list shows when each key was last used. ## The audit log **Audit Log** records what changed, when, and who did it — at the business level and across the whole organization. It covers changes your team makes in the dashboard and changes made through the API, so a single trail answers "who cancelled this subscription?" without anyone having to remember. Select **Security** to see only the sensitive changes: API keys, webhook endpoints, gateway accounts, integrations, mail settings, the team, two-factor settings and data exports. Reach for it when: - A customer says they were charged something nobody meant to charge them - A price or a billing rule changed and nobody remembers agreeing to it - You need to show, later, that something was done and by whom ## The request log **Developers → Request logs** shows each request your API keys made, reads and writes, and each change made in the dashboard: the status, the duration, the key or member, and the request and response bodies. Use it when a developer asks why a call failed. - Secrets are hidden before we store a request: passwords, tokens, API keys, card numbers and gateway credentials. Very large bodies are cut to a preview. - We keep writes for 90 days and reads for 30 days. - Every API response has a `Request-Id` header, such as `req_0a1b2c3d4e5f60718293a4b5c6d7e8f9`. Search for it in the request log to find that exact request. Its page links to the events, audit entries and gateway calls it caused. - Requests with an incorrect key or an unknown path are not in the log. Select **View requests** on an API key to see only that key's requests. ## Logs inside a business **Logs** inside a business is the other half: what Two Minute Billing sent to your payment provider and what came back, including the failures. Use the audit log for *who did what*, the request log for *what your integration sent*, and Logs for *what the provider said*. Between them, "why was this customer not charged?" is a question with an answer. ## Related - [Security: roles, passkeys and the audit log](https://twominutebilling.com/security) - [API keys and authentication](https://twominutebilling.com/help/developers/api-essentials/authentication) - [Custom roles](https://twominutebilling.com/help/developers/api-reference/organization/list-custom-roles) and [the request log](https://twominutebilling.com/help/developers/api-reference/organization/list-api-requests) in the API reference ## Sitemap See the full [sitemap](https://twominutebilling.com/sitemap.md) for all pages.