Managing Members

Members of a TofuPilot organization are managed from Settings > Members. Each member holds one access role and can belong to any number of access groups.

Inviting members, changing roles, and removing members requires the Admin or Owner role.

Invite a member

Open Settings > Members.

Enter the email, pick a role, and choose their access. For a Viewer, choose no access, the whole organization or an access group. For an Operator, no access or an access group. The choice starts from the organization's access for new members.

The invitee appears under Pending marked Invited and receives an email with a sign-up link that expires after seven days. If the invitee already has a TofuPilot account in another organization, the invitation links the existing account on accept.

Accept an invitation

Click the link in the invitation email to join. If you already have a TofuPilot account, the link adds you to the organization on sign-in. Otherwise you complete sign-up, and the membership activates once your email is verified.

Change a role

Find the member row.

Click the actions menu and select Change role.

Pick the new role and confirm.

The role applies immediately, with no sign-out required. You cannot change your own role; another Admin or Owner has to do it.

Manage access group assignments

Access groups scope which stations, test data and members a Viewer or an Operator can see, and a member can belong to any number of access groups. To change a member's assignments, click Edit on their row and open Change access groups. A Viewer added to an access group stays restricted to their access groups until you check Whole organization in the same menu. For the visibility rules and the full walkthrough, see access groups.

Make a viewer dashboard only

By default, every member except Operators can create personal API keys and connect AI agents through the MCP server. To limit a Viewer to the dashboard, for example a supplier, click Edit on their row and uncheck API and MCP access. Their row then shows Dashboard only.

From that moment, their API keys are refused on every request, they cannot create new ones (from the settings or with tofupilot login), and their MCP clients are refused. Nothing is deleted: checking API and MCP access again restores their existing keys and connections.

The setting only applies to Viewers. Owners, Admins and Developers manage stations, repositories and deployments, so they always keep API and MCP access. A Viewer promoted to another role gets it back, and returns to dashboard only if they become a Viewer again.

Review a member's API keys and MCP connections

Admins and Owners can see and revoke the personal API keys and MCP connections a member holds in the organization. Click Edit on their row and select API keys and MCP.

Revoking an API key deletes it. It stops working at once.
Revoking an MCP connection removes your organization from it. The member's AI agent keeps access to their other organizations, not to yours.

The list shows the first characters of each key, never the full key.

Remove a member

Removing a member revokes their access to your organization without deleting data: runs, procedures, and units they created stay accessible and keep their creator attribution. Their API keys and MCP connections for the organization are revoked at the same time.

Find the member row.

Click the actions menu and select Remove from organization.

Confirm.

Access is revoked immediately. To restore it, send a new invitation: the user keeps their TofuPilot account and any other organizations they belong to.

Owners cannot be removed directly. To change the Owner, contact support@tofupilot.com.

Access roles

Choose one of five roles, from Owner to Operator, to set what a member can do.

Access groups

Scope which stations suppliers, departments, or production lines can see.