Admin and settings
Manage organizations, members, API keys, integrations, and billing in the platform and CLI.
Org settings live under Manage in the platform app. The CLI covers the same surfaces where automation helps; deep how-tos stay on the linked pages.
| Task | Platform | CLI |
|---|---|---|
| Switch / inspect org | Org switcher | ax org |
| Invite members | Settings → Members | ax org invite (member only) |
| Roles, domains, rename | Settings | UI only |
| API keys | API keys (/account/api-keys) | ax api-key list / revoke |
| Secrets | Secrets | ax secret → Environment and Auth |
| GitHub / LLM providers | Integrations | ax integrations, ax llm-provider |
| Balance / buy credit | Billing | ax credit |
| Usage spend | Usage | ax credit spend |
Organizations
Create an org in the app (/orgs/create), then switch with the sidebar org switcher. Rename and delete are under Settings → General.
ax org list # * marks the active org
ax org view # name, id, your role, platform URL
ax org switch <ORG_ID>Most platform commands also take --org <org-id> for a one-off without changing the saved active org. Login and credentials: Environment and Auth.
Members and invites
Settings → Members is the full membership surface: invite, remove, and change roles. Settings is also where you register and verify email domains (required for CLI invites).
| Role | Typical access |
|---|---|
org:admin | Members, domains, org API keys, billing/credits, LLM providers |
org:member | Run experiments, use org secrets, personal spend |
Enterprise security (when provisioned) | LLM providers via org:llm_providers:manage; not a substitute for admin |
CLI invites are always members. Promote someone in Settings → Members.
# Org admin; emails must use a verified org domain
ax org invite dana@acme.com lee@acme.comMembership is the day-to-day trust boundary (any member can use org secrets). Details: Security, ax org invite.
API keys
Keys authenticate the CLI and the HTTP API. Create them under Manage → API keys (account route /account/api-keys). The CLI lists and revokes only; it never prints the secret again.
| Scope | Who creates | Use |
|---|---|---|
| User | Any signed-in user | Your identity across orgs you belong to |
| Organization | Org admin | Pinned to one org (CI, shared automation) |
Expiration choices in the UI: 1d, 7d, 30d, 90d, 1y (default 1y). ax auth login also mints a key.
ax api-key list
ax api-key view <KEY_ID>
# Rotate: revoke, then create a new key in the UI (or ax auth login)
ax api-key revoke <KEY_ID> --yesIntegrations
Manage → Integrations has two tabs:
| Tab | What it does | Docs |
|---|---|---|
| GitHub | Install the GitHub App, link repos for !ax run | GitHub CI, ax integrations |
| LLM Providers | Org BYOK, gateway toggle, Claude Code gateway compatibility | Model Providers and Fiveonefour's AI Gateway, ax llm-provider |
ax integrations gh connect
ax integrations gh link my-experiment owner/repo
ax llm-provider listBilling and usage
Prepaid credits fund managed model access and platform runs. There is no separate spend-limit setting: when the org balance hits zero, the platform can block new work and cancel in-flight runs. Buy more credit to continue.
| Who | Balance / reload | Spend |
|---|---|---|
| Org admin | Full org; may buy credit | Org-wide (optionally group by user or experiment) |
| Org member | Denied | Personal spend only |
ax credit balance
ax credit spend
ax credit spend --group-by experiment
ax credit reload --amount 50In the app, Billing covers plan and Stripe Customer Portal (payment methods, invoices); Billing → Credits and ax credit reload buy on-demand credit. Usage shows spend for the cycle. Plan vs on-demand expiry and micros: ax credit.
Gateway vs BYOK billing: Model Providers.
Related
- Environment and Auth: secret store, CLI login, credentials file
- Model Providers and Fiveonefour's AI Gateway: BYOK and managed access
- GitHub CI: PR-triggered runs
- Security: tenant isolation and key model
ax org·ax api-key·ax credit·ax secret