Every member of a workspace is assigned a role. The role decides which areas of the dashboard the person can open, which actions they can take, and whether they can manage other team members. Roles live on the Team page and are scoped per workspace, so the same email can be an Owner in one workspace and a Viewer in another.
This page is the reference for the five roles available today, what each one can do, and how to manage them.
The five roles
- Owner
The highest level of access. Owners can manage the entire workspace, including billing, team membership, payment provider connections, and account-wide security settings such as two-factor authentication enforcement. The person who creates a workspace becomes its first Owner. A workspace can have multiple Owners, and must retain at least one. Owners also keep password sign-in when a workspace requires Single Sign-On (SAML), so there is always a way in if your identity provider is unavailable. - Admin
Same broad access as the Owner across day-to-day operations. Admins can edit Cancel Flows, Payment Recovery, and Reactivation campaigns, manage billing, invite and manage team members, and connect or disconnect payment providers. Admins cannot enforce account-level two-factor authentication, grant the Owner role, change an Owner's role, or remove an Owner. - Developer
Built for engineers integrating Churnkey. Developers can edit Cancel Flows, Payment Recovery, and Reactivation campaigns, manage API keys, and configure custom domains. They do not have access to billing or team management. - Member
Day-to-day operator role. Members can edit Cancel Flows, Payment Recovery, and Reactivation campaigns. They cannot access billing, team management, API keys, or payment provider settings. - Viewer
Read-only access. Viewers can browse Cancel Flows, Payment Recovery, Reactivations, and the analytics pages, but cannot create or edit anything.
Permissions reference
The matrix below summarizes what each role can do across the dashboard. Edit means the role can both view and change the area. View means read-only access. A dash means the role does not have access.
| Capability | Owner | Admin | Developer | Member | Viewer |
|---|---|---|---|---|---|
| Cancel Flows | Edit | Edit | Edit | Edit | View |
| Payment Recovery | Edit | Edit | Edit | Edit | View |
| Reactivations | Edit | Edit | Edit | Edit | View |
| Billing and invoices | Edit | Edit | View | View | View |
| Team management | Edit | Edit | View | View | View |
| Payment provider | Edit | Edit | View | View | View |
| API keys | Edit | Edit | Edit | - | - |
| Custom domains | Edit | Edit | Edit | View | View |
| Data export (CSV from analytics) | Yes | Yes | - | - | - |
| Account-level 2FA enforcement | Yes | - | - | - | - |
Capabilities by feature area
Cancel Flows
Owner, Admin, Developer, and Member can create new flows, edit existing ones, configure segments, and publish changes. Viewer can browse the flow builder and analytics in read-only mode. See Cancel Flow configuration for what these areas cover.
Payment Recovery
Owner, Admin, Developer, and Member can edit Payment Recovery campaigns, exclusions, and advanced settings. Viewer can browse campaigns and analytics in read-only mode. See Payment Recovery getting started.
Reactivations
Owner, Admin, Developer, and Member can edit Reactivation campaigns and exclusions. Viewer is read-only. See Reactivations.
Billing and invoices
Owner and Admin can view invoices, update the payment method on file, and cancel the Churnkey subscription. Developer, Member, and Viewer can see the billing page but cannot make changes.
Team management
Owners and Admins can invite and manage members at their own role level or below. Only Owners can promote another member to Owner, change an Owner's role, or remove an Owner. Churnkey prevents removing or demoting the last Owner, even if Admins remain. Developer, Member, and Viewer can see the Team page but cannot edit anyone.
Payment provider
Owner and Admin can connect or disconnect billing providers (Stripe, Chargebee, Braintree, Paddle, Maxio). Developer, Member, and Viewer can see the configured provider but cannot change the connection.
API keys
Owner, Admin, and Developer can create and revoke API keys for the workspace. Member and Viewer cannot access API keys at all.
Custom domains
Owner, Admin, and Developer can configure custom domains for hosted Churnkey pages and custom sender domains for emails. Member and Viewer can view the configured domains.
Data export
Pulling a CSV from the Activity Stream and from Payment Recovery analytics is restricted to Owner and Admin only. The same restriction is enforced on the API, so it cannot be bypassed by URL.
Account-level 2FA enforcement
Only the Owner can require all members of the workspace to use 2FA when logging in. Admins can manage their own 2FA settings, but cannot enforce 2FA on other members.
Managing roles
The Team page is where Owners and Admins manage who has access to the workspace. The page is titled Team Members with the subtitle Manage who has access to Churnkey.
The page shows a table of every current member with the following columns:
- Name
- Role
- Developer Notifications (whether the member receives developer-targeted alerts)
- Actions (edit role, remove member)
To change a member's role, click the actions menu next to their row and choose Edit Role. A dialog opens with a role picker and a live preview of the permissions matrix that updates as you select different roles. You can only assign roles that are equal to or lower than your own role. Owners can select Owner to promote an existing member. Admins cannot select Owner, and Edit Role and Remove are disabled for Owner rows.
Inviting members
From the Team page, click Invite via Email to open the invite dialog. Fill in:
- First name
- Last name
- Email address
- New User Role (dropdown defaults to Member)
The role dropdown lists every role that is equal to or lower than your own. Owner is not available from this dialog. To add an Owner, invite the person first, then have an existing Owner promote them through Edit Role. After clicking Send Invite, the invitee receives an email with a link to accept the invitation. You will see a Member invitation sent confirmation in the dashboard.
If the invited email is already part of another Churnkey workspace, accepting the invitation links the new workspace to the existing account automatically. The user does not need to create a separate login. See Multi-Workspace Support for the full multi-workspace login flow.
Common questions
Can the Owner role be transferred to another member?
Yes. An existing Owner can go to Team > Members, choose Edit Role for another member, and set their role to Owner. Once another Owner exists, an Owner can change the previous Owner's role or remove them. Churnkey blocks any change that would leave the workspace without an Owner.
What if our existing workspace has no Owner?
Existing Admins are not automatically promoted to Owner. If nobody has the Owner role, contact Churnkey support through the in-app chat or [email protected] for help assigning an Owner.
Can a workspace have more than one Owner?
Yes. An existing Owner can promote additional members to Owner. Each Owner has the same ownership permissions.
Why doesn't my Member account have an Export Data button?
Data export is restricted to the Owner and Admin roles. Ask the workspace Owner or an Admin to either run the export for you or upgrade your role.
Can the same person have different roles in different workspaces?
Yes. Roles are scoped to a single workspace, so the same email can be an Owner in one workspace and a Viewer in another. See Multi-Workspace Support.
Where do role changes show up?
Role changes are recorded in the workspace Activity Log, including the previous and new roles. A role change takes effect on the user's next page load. They do not need to log out and back in.