---
title: Organizations
description: Manage your organizations and their resources.
---

Daytona provides organizations as a way to group resources and enable collaboration. Users can work individually in their personal organization or together in a collaborative organization.

Manage your organizations in the [Daytona Dashboard ↗](https://app.daytona.com/dashboard) or through the [API](/docs/v2/api/daytona).

## Personal vs Collaborative

Every Daytona user starts with a personal organization for solo use and experimentation. Collaborative organizations are created manually for teams, with shared access and controls.

| **Feature**        | **Personal organization**        | **Collaborative organization**                 |
| ------------------ | -------------------------------- | ---------------------------------------------- |
| **Creation**       | Automatic on signup              | Manually by a user                             |
| **Members**        | Single user only                 | Multiple users (invite-based)                  |
| **Access Control** | No roles or permissions          | Roles with fixed permission sets               |
| **Billing**        | Tied to individual user          | Shared across team members                     |
| **Use Case**       | Personal testing, small projects | Company/team development and production        |
| **Quota Scope**    | Per user                         | Shared across all members                      |
| **Deletable**      | No                               | Yes (by admins)                                |

Switch between personal and collaborative organizations with the dropdown in the [Daytona Dashboard ↗](https://app.daytona.com/dashboard) sidebar. Each organization has its own sandboxes, API keys, and resource quotas.

## Create organization

Create organizations in the [Daytona Dashboard ↗](https://app.daytona.com/dashboard/) or with the [API](/docs/v2/api/daytona).

1. Go to [Daytona Dashboard ↗](https://app.daytona.com/dashboard/)
2. Expand the dropdown at the top-left corner of the sidebar to view your organizations
3. Click <Button>Create Organization</Button>
4. Enter the organization name
5. Select a [region](/docs/v2/regions)
6. Click <Button>Create</Button>

<Tabs syncKey="language">
<TabItem label="CLI" icon="seti:shell">

```bash
daytona org create 'My Organization'
```

</TabItem>
<TabItem label="API" icon="seti:json">

```bash
curl 'https://api.daytona.com/orgs' \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --data '{
  "name": "My Organization"
}'
```

| **Field** | **Type** | **Description**                                                                                                             |
| --------- | -------- | --------------------------------------------------------------------------------------------------------------------------- |
| `name`    | `string` | Required. Trimmed, and must be 1 to 100 characters with no control characters; otherwise the request returns `400 Bad Request`. |

<Callout type="note" title="Notes">
- The caller becomes the first admin of the organization.
- The response is the caller's membership in the new organization, including the caller's roles and permissions.
</Callout>

</TabItem>
</Tabs>

## Operations

### List organizations

List all organizations the authenticated user belongs to.

<Tabs syncKey="language">
<TabItem label="CLI" icon="seti:shell">

```bash
daytona org list
```

</TabItem>
<TabItem label="API" icon="seti:json">

```bash
curl 'https://api.daytona.com/orgs' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```

</TabItem>
</Tabs>

### Select organization

Select the organization that following CLI commands run against. The CLI also restores the [project](/docs/v2/projects#select-project) you last used in that organization, or its default project. Pass an ID or an unambiguous name; with no argument, the CLI shows a picker at a terminal.

<Tabs syncKey="language">
<TabItem label="CLI" icon="seti:shell">

```bash
daytona org use ORGANIZATION_ID
```

</TabItem>
</Tabs>

### Get by ID

Get an organization by ID.

<Tabs syncKey="language">
<TabItem label="CLI" icon="seti:shell">

```bash
daytona org get ORGANIZATION_ID
```

</TabItem>
<TabItem label="API" icon="seti:json">

```bash
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```

</TabItem>
</Tabs>

### Current user

<Tabs syncKey="language">
<TabItem label="CLI" icon="seti:shell">

```bash
# The signed-in user, the credential in use, and the selected organization and project
daytona whoami
```

</TabItem>
<TabItem label="API" icon="seti:json">

```bash
# The calling user: id, email, name
curl 'https://api.daytona.com/me' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```

</TabItem>
</Tabs>

### Current organization API key

Get the organization API key that authenticates the request, with the organization permissions it holds now. The route accepts organization API keys only; a signed-in user token returns `403`. The response never contains the token.

<Tabs syncKey="language">
<TabItem label="API" icon="seti:json">

```bash
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/api-keys/current' \
  --header 'Authorization: Bearer YOUR_ORG_API_KEY'
```

```json
{
  "id": "KEY_ID",
  "org_id": "ORGANIZATION_ID",
  "name": "my-org-key",
  "key_prefix": "dtno_...",
  "org_permissions": ["read:audit"],
  "created_at": "2026-09-10T12:00:00Z",
  "expires_at": null,
  "last_used_at": "2026-09-11T08:30:00Z",
  "revoked_at": null
}
```

</TabItem>
</Tabs>

### Rename organization

Rename an organization. The new name follows the same rules as on create: it is trimmed, and must be 1 to 100 characters with no control characters.

<Tabs syncKey="language">
<TabItem label="CLI" icon="seti:shell">

```bash
daytona org update ORGANIZATION_ID --name 'New Organization Name'
```

</TabItem>
<TabItem label="API" icon="seti:json">

```bash
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID' \
  --request PATCH \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --data '{
  "name": "New Organization Name"
}'
```

</TabItem>
</Tabs>

### Leave organization

Leave an organization.

1. Go to [Daytona Dashboard ↗](https://app.daytona.com/dashboard/)
2. Expand the dropdown at the top-left corner of the sidebar to view your organizations
3. Select the organization you want to leave
4. Click <Button>Settings</Button> in the sidebar
5. Click <Button>Leave Organization</Button>
6. Confirm by clicking <Button>Leave</Button>

<Tabs syncKey="language">
<TabItem label="CLI" icon="seti:shell">

```bash
daytona org leave ORGANIZATION_ID
```

<Callout type="note" title="Notes">
- `daytona org leave` asks for confirmation.
- `daytona org leave` revokes the API keys you minted in the organization.
- `daytona org leave` forgets the project keys and platform tokens that the CLI cached for the organization.
</Callout>

</TabItem>
<TabItem label="API" icon="seti:json">

```bash
# Leaving is a self-removal: USER_ID is the id returned by GET /me
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/members/USER_ID' \
  --request DELETE \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```

<Callout type="note" title="Notes">
- Leaving revokes every project and organization API key you minted in the organization.
- Leaving deletes the signed preview grants you minted.
</Callout>

</TabItem>
</Tabs>

### Delete organization

Delete an organization.

1. Go to [Daytona Dashboard ↗](https://app.daytona.com/dashboard/)
2. Expand the dropdown at the top-left corner of the sidebar to view your organizations
3. Select the organization you want to delete
4. Click <Button>Settings</Button> in the sidebar
5. Click <Button>Delete Organization</Button>
6. Confirm the deletion by typing the organization name and clicking <Button>Delete</Button>

<Tabs syncKey="language">
<TabItem label="CLI" icon="seti:shell">

```bash
daytona org delete ORGANIZATION_ID
```

<Callout type="note" title="Notes">
- `daytona org delete` asks for confirmation before deleting.
- You cannot delete a personal organization.
</Callout>

</TabItem>
<TabItem label="API" icon="seti:json">

```bash
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID' \
  --request DELETE \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```

<Callout type="note" title="Notes">
- A successful delete revokes every API key in every project.
- A successful delete removes the organization's members, invitations, service accounts, and projects.
</Callout>

</TabItem>
</Tabs>

## Limits

Get the effective [organization limits](/docs/v2/limits#organization-limits) and the current usage they are checked against. Each limit reports its effective cap and the usage counted against it. The member limit also counts the pending invitations that reserve a seat. A read with an API key returns the limits of the API key's organization and leaves out the member limit.

<Tabs syncKey="language">
<TabItem label="Python" icon="seti:python">

```python
from daytona import Daytona

daytona = Daytona()

limits = daytona.v2.get_limits()
concurrent = limits.sandboxes.concurrent
print(f"Concurrent sandboxes: {concurrent.usage} of {concurrent.limit}")
```

<Callout type="note" title="Notes">
- The API key needs the `read:limits` permission.
- With `jwt_token` authentication, pass `organization_id`.
</Callout>

</TabItem>
<TabItem label="TypeScript" icon="seti:typescript">

```typescript
import { Daytona } from '@daytona/sdk'

const daytona = new Daytona()

const limits = await daytona.v2.getLimits()
const concurrent = limits.sandboxes.concurrent
console.log(`Concurrent sandboxes: ${concurrent.usage} of ${concurrent.limit}`)
```

<Callout type="note" title="Notes">
- The API key needs the `read:limits` permission.
- With `jwtToken` authentication, pass `organizationId`.
</Callout>

</TabItem>
<TabItem label="CLI" icon="seti:shell">

```bash
# The argument is optional; omit it to use the selected organization
daytona org limits ORGANIZATION_ID
```

<Callout type="note" title="Notes">
- `daytona org limits` requires the `read:organization` permission, or `read:limits` with an API key.
</Callout>

</TabItem>
<TabItem label="API" icon="seti:json">

```bash
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/limits' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```

```json
{
  "sandboxes": {
    "concurrent": { "limit": 10, "usage": 2 },
    "total": { "limit": 50, "usage": 4 },
    "gpu_concurrent": { "limit": 0, "usage": 0 },
    "windows_concurrent": { "limit": 0, "usage": 0 }
  },
  "image_builds": { "concurrent": { "limit": null, "usage": 0 } },
  "members": { "limit": 5, "usage": 3, "pending_invitations": 1 },
  "api_keys_per_organization": { "limit": 1000, "usage": 12 },
  "api_keys_per_project": { "limit": 100, "usage": 7 },
  "secrets_per_project": { "limit": 500, "usage": 20 }
}
```

The response has the following fields:

| **Field**                   | **Description**                                                                                                     |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------- |
| `limit`                     | Each limit reports its effective cap in `limit`. A value of `null` means no limit. Reaching the cap refuses new work. |
| `usage`                     | Each limit reports the current usage counted against it in `usage`.                                                 |
| `sandboxes`                 | The concurrent and total sandbox limits.                                                                            |
| `image_builds`              | The concurrent image build limit.                                                                                   |
| `members`                   | The seat cap. `pending_invitations` counts the invitations that reserve a seat until they are accepted or declined. |
| `api_keys_per_organization` | The live API key limit of the organization.                                                                         |
| `api_keys_per_project`      | The live API key limit of any one project, with the highest current usage.                                          |
| `secrets_per_project`       | The secret limit of any one project, with the highest current usage.                                                |

<Callout type="note" title="Notes">
- `GET /orgs/ORGANIZATION_ID/limits` requires the `read:organization` permission, or `read:limits` with an API key.
</Callout>

</TabItem>
</Tabs>

### Set the timeout cap

Set or clear the organization's maximum sandbox timeout. Daytona validates every sandbox [timeout](/docs/v2/linux-sandboxes#timeout) against this cap. The cap can be any value up to the platform maximum, which is 86400 seconds by default; clearing it inherits the platform maximum. The organization reports the cap as `max_sandbox_timeout_seconds`.

<Tabs syncKey="language">
<TabItem label="API" icon="seti:json">

```bash
# Cap every sandbox timeout in the organization at 1 hour
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID' \
  --request PATCH \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --data '{ "max_sandbox_timeout_seconds": 3600 }'

# Clear the cap and inherit the platform maximum
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID' \
  --request PATCH \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --data '{ "max_sandbox_timeout_seconds": null }'
```

| **Field**                     | **Type**  | **Description**                                                                                     |
| ----------------------------- | --------- | --------------------------------------------------------------------------------------------------- |
| `max_sandbox_timeout_seconds` | `integer` | Sets the cap in seconds, up to the platform maximum. A value of `null` clears the cap. A value above the platform maximum returns `400`. |

<Callout type="note" title="Notes">
- The response is the updated organization.
- Setting the cap accepts only a signed-in user token and requires the `write:organization` permission.
</Callout>

</TabItem>
</Tabs>

## Entitlements and feature flags

Entitlements are the capabilities an organization's plan grants; feature flags are platform switches evaluated per organization. Both are read-only and return every catalog key, so a client never has to guess at an absent key. Requires `read:organization`, which every role includes.

### Entitlements

<Tabs syncKey="language">
<TabItem label="API" icon="seti:json">

```bash
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/entitlements' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```

```json
{
  "entitlements": {
    "preview_warning_opt_out": false
  }
}
```

</TabItem>
</Tabs>

### Feature flags

<Tabs syncKey="language">
<TabItem label="API" icon="seti:json">

```bash
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/feature-flags' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```

</TabItem>
</Tabs>

## Preview warning

Turn the preview warning page off or on. It applies to every [sandbox preview](/docs/v2/preview) in the organization and decides whether a visitor sees the warning page first.

<Callout type="note" title="Plan required">
Turning the preview warning off is available on request.
</Callout>

<Tabs syncKey="language">
<TabItem label="API" icon="seti:json">

```bash
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/preview-warning' \
  --request PATCH \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{ "disabled": true }'
```

| **Field** | **Type** | **Description** |
| --------- | -------- | --------------- |
| `disabled` | `boolean` | Turns the preview warning off when `true` and on when `false`. |

<Callout type="note" title="Notes">
- `PATCH /orgs/ORGANIZATION_ID/preview-warning` requires the `write:organization` permission.
- The preview warning has no `GET` route.
- The current value is the `preview_warning_disabled` field of the organization that the list and get routes return.
</Callout>

</TabItem>
</Tabs>

## Telemetry forwarding

### Get the configuration

Get the telemetry forwarding configuration. Daytona forwards the organization's sandbox logs, traces, and metrics to the OTLP/HTTP endpoint in this configuration. The response lists the names of the configured request headers; header values are write-only and never returned.

<Tabs syncKey="language">
<TabItem label="API" icon="seti:json">

```bash
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/otel-config' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```

```json
{
  "endpoint": "https://otel.example.com",
  "header_names": ["Authorization"],
  "created_at": "2026-09-10T12:00:00Z",
  "updated_at": "2026-09-10T12:00:00Z"
}
```

</TabItem>
</Tabs>

### Set the configuration

Set telemetry forwarding. Each write replaces the whole configuration, including headers.

<Tabs syncKey="language">
<TabItem label="API" icon="seti:json">

```bash
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/otel-config' \
  --request PUT \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{
  "endpoint": "https://otel.example.com",
  "headers": { "Authorization": "Bearer YOUR_COLLECTOR_TOKEN" }
}'
```

| **Field**  | **Type** | **Description**                                                                                                                                                                                                                  |
| ---------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `endpoint` | `string` | Required. Must use `https`, be at most 2048 bytes, and resolve only to public IP addresses; `localhost` and local host names are refused. The collector appends `/v1/logs`, `/v1/traces`, or `/v1/metrics` to the endpoint for each signal. |
| `headers`  | `object` | Holds at most 16 entries and at most 16 KiB of names and values in total. Header names are 1 to 128 bytes and unique regardless of case. Header values are 1 to 4096 bytes of visible ASCII, space, or tab. You cannot set transport headers such as `Host`, `Content-Type`, and `Content-Length`. You also cannot set `User-Agent` or any `Proxy-*` header. To keep a stored header value without resending the value, pass `********` as the value. |

</TabItem>
</Tabs>

### Delete the configuration

Delete the telemetry forwarding configuration. Sandbox telemetry stops being forwarded.

<Tabs syncKey="language">
<TabItem label="API" icon="seti:json">

```bash
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/otel-config' \
  --request DELETE \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```

<Callout type="note" title="Notes">
- The request returns `204 No Content`, also when no configuration is set.
</Callout>

</TabItem>
</Tabs>

## macOS settings

The macOS settings control [auto-reserve](/docs/v2/macos-sandboxes#auto-reserve) for [macOS sandboxes](/docs/v2/macos-sandboxes). With auto-reserve on, a macOS create in a region where the organization holds no live Mac reservation buys a 24-hour reservation that renews while a sandbox runs on it. Auto-reserve is on by default, and the organization caps how many auto-reserved reservations it holds at once.

### Get the settings

Get the organization's macOS settings.

<Tabs syncKey="language">
<TabItem label="API" icon="seti:json">

```bash
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/macos-settings' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```

```json
{
  "macos_auto_reserve": true,
  "macos_auto_reserve_max_reservations": 2,
  "macos_auto_reserve_disabled_at": null,
  "macos_auto_reserve_disabled_by": null
}
```

The response has the following fields:

| **Field**                              | **Description**                                                                                     |
| -------------------------------------- | --------------------------------------------------------------------------------------------------- |
| `macos_auto_reserve`                   | Shows whether auto-reserve is on.                                                                   |
| `macos_auto_reserve_max_reservations`  | The most auto-reserved reservations the organization holds at once.                                 |
| `macos_auto_reserve_disabled_at`       | Records when auto-reserve was last turned off. The value is `null` while auto-reserve is on.        |
| `macos_auto_reserve_disabled_by`       | Records who last turned auto-reserve off. The value is `null` while auto-reserve is on.             |

<Callout type="note" title="Notes">
- `GET /orgs/ORGANIZATION_ID/macos-settings` requires the `read:organization` permission.
</Callout>

</TabItem>
</Tabs>

### Set the settings

Turn auto-reserve on or off, or change the cap on auto-reserved reservations. Fields left out of the request keep their stored values.

<Tabs syncKey="language">
<TabItem label="API" icon="seti:json">

```bash
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/macos-settings' \
  --request PATCH \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{ "macos_auto_reserve": true, "macos_auto_reserve_max_reservations": 4 }'
```

| **Field**                              | **Type** | **Description**                                                                       |
| -------------------------------------- | -------- | ------------------------------------------------------------------------------------- |
| `macos_auto_reserve`                   | boolean  | Turns auto-reserve on or off. If omitted, the stored value stays unchanged. Turning auto-reserve off while it is already off keeps the original `macos_auto_reserve_disabled_at` and `macos_auto_reserve_disabled_by`. Turning auto-reserve on clears both fields. |
| `macos_auto_reserve_max_reservations`  | integer  | Sets the most auto-reserved reservations the organization holds at once. If omitted, the stored value stays unchanged. The value must be at least `1`. A cap below `1` returns `400`. |

<Callout type="note" title="Notes">
- `PATCH /orgs/ORGANIZATION_ID/macos-settings` requires the `write:organization` permission.
- Set at least one field in the request.
</Callout>

</TabItem>
</Tabs>

## Roles

Each member of an organization holds one or more roles. A role is a fixed set of permissions, and a member's permissions are the union of the permissions of all roles they hold. The admin role is protected: the organization must always keep at least one admin, and only an admin can grant or remove it. An invitation that names no roles grants the developer role.

| **Role**                       | **Description**                                                                                      |
| ------------------------------ | ---------------------------------------------------------------------------------------------------- |
| **`admin`**                    | Full control of the organization, its members, and everything in it                                  |
| **`maintainer`**               | Full control of everything inside the organization's projects, with no authority over the organization itself |
| **`developer`**                | Run and manage sandboxes, invoke functions, and view everything a sandbox can use                    |
| **`read-only`**                | View every project resource, and change none of them                                                 |
| **`member`**                   | Sign in and see the organization, with no access to any resource                                     |
| **`auditor`**                  | Read the organization's [audit log](/docs/v2/audit-logs), without the ability to turn it off         |
| **`billing`**                  | See what the organization spends and manage how it pays                                              |
| **`spending-viewer`**          | See what the organization spends, and nothing about how it pays                                      |
| **`sso-admin`**                | Configure [single sign-on](/docs/v2/sso) for the organization                                        |
| **`infrastructure-admin`**     | Read-only access to the organization. A reserved role kept so existing assignments continue to work  |
| **`sandboxes-manager`**        | Create, change, and delete sandboxes                                                                 |
| **`snapshots-manager`**        | Create, change, and delete snapshots and images                                                      |
| **`volumes-manager`**          | Create, change, and delete volumes                                                                   |
| **`registries-manager`**       | Create, change, and delete private container registries                                              |
| **`secrets-manager`**          | Create, change, and delete project secrets                                                           |
| **`functions-manager`**        | Deploy, invoke, change, and delete serverless functions                                              |

### List roles

List all roles in an organization.

<Tabs syncKey="language">
<TabItem label="CLI" icon="seti:shell">

```bash
# The fixed role catalog and the permission each role grants
daytona role list
```

</TabItem>
<TabItem label="API" icon="seti:json">

```bash
# The fixed role catalog and the permission each role grants
curl 'https://api.daytona.com/roles' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```

</TabItem>
</Tabs>

### List permissions

List the permissions that roles and API keys grant. Each permission has an identifier, a display name, and a display category. Project permissions apply to the resources inside a project, and organization permissions apply to the organization itself.

<Tabs syncKey="language">
<TabItem label="API" icon="seti:json">

```bash
# Every permission; scope=project or scope=organization restricts the list to one scope
curl 'https://api.daytona.com/permissions?scope=project' \
  --header 'Authorization: Bearer YOUR_API_KEY'
```

| **Parameter** | **Type**  | **Description**                                                                                     |
| ------------- | --------- | --------------------------------------------------------------------------------------------------- |
| `scope`       | `string`  | Restricts the list to `project` or `organization` permissions. Omit it to list both. Any other value returns `400 Bad Request`. |

<Callout type="note" title="Notes">
- The route accepts any credential and requires no permission.
</Callout>

</TabItem>
</Tabs>

## Members

Daytona provides methods to manage members in an organization.

### List members

List all members in an organization.

<Tabs syncKey="language">
<TabItem label="CLI" icon="seti:shell">

```bash
daytona member list --org ORGANIZATION_ID
```

</TabItem>
<TabItem label="API" icon="seti:json">

```bash
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/members' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```

</TabItem>
</Tabs>

### Invite members

Invite a new user to an organization.

1. Go to [Daytona Dashboard ↗](https://app.daytona.com/dashboard/members)
2. Click <Button>Invite Member</Button>
3. Enter the email address of the user you want to invite
4. Select one or more [roles](#roles) for the new user under **Roles**

<Tabs syncKey="language">
<TabItem label="CLI" icon="seti:shell">

```bash
daytona invite create mail@example.com --org ORGANIZATION_ID --role developer
```

| **Flag** | **Type** | **Description**                       |
| -------- | -------- | ------------------------------------- |
| `--role` | `string` | A comma-separated list of role slugs. |

<Callout type="note" title="Notes">
- When the deployment sends no email, `daytona invite create` prints the invitation link instead.
</Callout>

</TabItem>
<TabItem label="API" icon="seti:json">

```bash
# roles defaults to ["developer"] when omitted
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/invitations' \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --data '{
  "email": "mail@example.com",
  "roles": ["developer"]
}'
```

<Callout type="note" title="Notes">
- An invitation expires 14 days after you send the invitation.
- Inviting the same address again issues a new token.
- Inviting the same address again resends the invitation.
- Seated members and open invitations count toward the seat cap.
- The response carries `accept_url` only when the deployment sends no email.
</Callout>

</TabItem>
</Tabs>

### Remove members

Remove a user from an organization.

1. Go to [Daytona Dashboard ↗](https://app.daytona.com/dashboard/members)
2. Click <Button>Remove</Button> next to the user you want to remove
3. Confirm the removal by clicking <Button>Remove</Button>

<Tabs syncKey="language">
<TabItem label="CLI" icon="seti:shell">

```bash
# Preview what the member loses before removing them
daytona member remove USER_ID --org ORGANIZATION_ID --preview

daytona member remove USER_ID --org ORGANIZATION_ID
```

</TabItem>
<TabItem label="API" icon="seti:json">

```bash
# Preview what the member loses before removing them
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/members/USER_ID/removal-preview' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'

curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/members/USER_ID' \
  --request DELETE \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```

The response has the following fields:

| **Field**                | **Description**                                                                                                              |
| ------------------------ | ---------------------------------------------------------------------------------------------------------------------------- |
| `revoked_keys`           | Holds the count of project and organization API keys that the removal revokes.                                               |
| `revoked_preview_grants` | Holds the count of signed preview grants that the removal deletes. In the preview response, the value is `null` when the count is unknown, not `0`. |

<Callout type="note" title="Notes">
- Removing another member requires the `delete:members` permission.
</Callout>

</TabItem>
</Tabs>

### Update access

Update the access of a member in an organization.

1. Go to [Daytona Dashboard ↗](https://app.daytona.com/dashboard/members)
2. Click the three-dot menu on the member row
3. Click <Button>Edit roles</Button>
4. Select the member's [roles](#roles) and click <Button>Save</Button>

<Tabs syncKey="language">
<TabItem label="CLI" icon="seti:shell">

```bash
# Replace the member's role set
daytona member update USER_ID --org ORGANIZATION_ID --role maintainer,billing

# Rehearse the change without applying it
daytona member update USER_ID --org ORGANIZATION_ID --role read-only --dry-run
```

</TabItem>
<TabItem label="API" icon="seti:json">

```bash
# Replace the member's role set
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/members/USER_ID' \
  --request PATCH \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --data '{
  "roles": ["maintainer", "billing"]
}'

# Rehearse the change without applying it: { "revoked_api_keys": ..., "revoked_preview_grants": ... }
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/members/USER_ID/update-preview' \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --data '{
  "roles": ["read-only"]
}'
```

| **Field** | **Type**   | **Description**                                      |
| --------- | ---------- | ---------------------------------------------------- |
| `roles`   | `string[]` | Required. Replaces the member's whole role set.      |

<Callout type="note" title="Notes">
- You cannot change your own roles.
- You can change only a member whose current and new permissions you hold.
- Only an admin can grant or remove the `admin` role.
</Callout>

</TabItem>
</Tabs>

## Invitations

View an organization invitation from the link or token in the invitation email.

1. Open the link in the invitation email; it opens [Daytona Dashboard ↗](https://app.daytona.com/dashboard/user/invitations)
2. Review the organization, inviter, roles, and expiry of the invitation

<Tabs syncKey="language">
<TabItem label="CLI" icon="seti:shell">

```bash
# Show the invitation behind the dtni_ token or the link from the invitation email
daytona invite show INVITATION_TOKEN
```

</TabItem>
<TabItem label="API" icon="seti:json">

```bash
# Show the invitation behind the dtni_ token from the invitation email
curl 'https://api.daytona.com/invitations/lookup' \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --data '{ "token": "INVITATION_TOKEN" }'
```

</TabItem>
</Tabs>

### Accept invitation

Accept a pending organization invitation.

1. Open the link in the invitation email; it opens [Daytona Dashboard ↗](https://app.daytona.com/dashboard/user/invitations)
2. Sign in if prompted
3. Review the organization, inviter, roles, and expiry of the invitation
4. Click <Button>Accept</Button>

<Tabs syncKey="language">
<TabItem label="CLI" icon="seti:shell">

```bash
daytona invite accept INVITATION_TOKEN
```

</TabItem>
<TabItem label="API" icon="seti:json">

```bash
curl 'https://api.daytona.com/invitations/accept' \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --data '{ "token": "INVITATION_TOKEN" }'
```

<Callout type="note" title="Notes">
- The token is single-use.
- If you are already a member, you keep your roles.
- If you are already a member, accepting still consumes the invitation.
</Callout>

</TabItem>
</Tabs>

Once a user accepts an invitation to join an organization, they get access to the organization's resource quotas and can create an [API key](/docs/v2/api-keys) and sandboxes.

### Decline invitation

Decline a pending organization invitation.

1. Open the link in the invitation email; it opens [Daytona Dashboard ↗](https://app.daytona.com/dashboard/user/invitations)
2. Sign in if prompted
3. Review the organization, inviter, roles, and expiry of the invitation
4. Click <Button>Decline</Button>
5. Confirm by clicking <Button>Decline</Button>

<Tabs syncKey="language">
<TabItem label="CLI" icon="seti:shell">

```bash
daytona invite decline INVITATION_TOKEN
```

</TabItem>
<TabItem label="API" icon="seti:json">

```bash
curl 'https://api.daytona.com/invitations/decline' \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --data '{ "token": "INVITATION_TOKEN" }'
```

<Callout type="note" title="Notes">
- The organization sees the invitation as declined until the invitation is revoked or the address is invited again.
</Callout>

</TabItem>
</Tabs>

### List pending

List pending invitations for an organization.

<Tabs syncKey="language">
<TabItem label="CLI" icon="seti:shell">

```bash
daytona invite list --org ORGANIZATION_ID
```

</TabItem>
<TabItem label="API" icon="seti:json">

```bash
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/invitations' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```

<Callout type="note" title="Notes">
- The list contains every invitation that has not been accepted, including pending, declined, and expired invitations.
- Use `declined_at` and `expires_at` to tell pending, declined, and expired invitations apart.
</Callout>

</TabItem>
</Tabs>

### Cancel invitation

Cancel an invitation for an organization.

1. Go to [Daytona Dashboard ↗](https://app.daytona.com/dashboard/members)
2. Scroll to the **Invitations** table
3. Click the three-dot menu on the invitation row
4. Click <Button>Cancel</Button>
5. Confirm by clicking <Button>Confirm</Button>

<Tabs syncKey="language">
<TabItem label="CLI" icon="seti:shell">

```bash
daytona invite revoke INVITATION_ID --org ORGANIZATION_ID
```

</TabItem>
<TabItem label="API" icon="seti:json">

```bash
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/invitations/INVITATION_ID' \
  --request DELETE \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```

</TabItem>
</Tabs>