Teams, API keys and audit log
Invite your team with roles, sign in with SSO, create API keys, and see who changed what.
Members and roles
| Role | Can |
|---|---|
| Member | View databases, backups, Proof results and activity. |
| Admin | Everything a member can, plus adopt databases, run tasks, restart PostgreSQL (on servers that allow it), Rewind (restore copies, bring back rows, rewind a database), manage hosts, alert rules, API keys and members. |
| Owner | Everything, including billing and what AI agents may do. |
Admins and owners invite people under Settings → Members (invitations expire after 7 days). Only owners can make or change an owner. The organization's creator is its first owner.
Single sign-on
Sign in with your identity provider, over SAML or OIDC. One per organization, on every plan. Owners set it up under Settings → Single sign-on:
Prove your domain
Type your team's email domain (like example.com). Add the TXT record Rowsafe shows (_rowsafe-sso.example.com) at your DNS provider, then click Check. DNS can take a few minutes.
Connect your identity provider
- SAML: in your identity provider, add an app with the ACS URL and Entity ID Rowsafe shows, and send the email as the NameID. Paste its metadata URL or XML.
- OIDC: add a web app with the redirect URL Rowsafe shows. Paste its issuer URL, client ID and client secret.
Require SSO (optional)
People with an email on your domain can then only sign in with SSO. Members who aren't owners are signed out once and sign back in with SSO. Owners can still use their password, Google or GitHub, so you're never locked out.
People sign in with Sign in with SSO and their work email. Someone new from your domain joins as a member, also when they sign in with Google or GitHub using an email on the verified domain. Every SSO sign-in is in the audit log.
Remove in the same place removes the domain and the connection. People who only used SSO reset their password to sign in.
API keys
The CLI, scripts, CI and AI agents use API keys (rsk_...).
- On your machine: run
rowsafe login, approve it in the dashboard (admins and owners only), and a key is made for you. - For CI and servers: create a key under Settings → API keys and pass it with
ROWSAFE_API_KEYorrowsafe login --key. See Save a Mark before every deploy.
rowsafe api-keys create deploy-ci
rowsafe api-keys create dashboards --read-only
rowsafe api-keys list
rowsafe api-keys revoke key_...- A key is shown once. Rowsafe stores only a hash. Keep it in a secret manager.
- A read-only key can only read. Anything else gets
This API key is read-only. - Revoking takes effect on the next request. A key can't revoke itself.
rowsafe logoutrevokes the keyrowsafe loginmade. Keys given with--keystay valid.
A read-write key follows its person's role: whoever created it in the dashboard or approved the rowsafe login (shown in Settings → API keys). Before each change, Rowsafe checks that person's current role:
- Admin or owner: the change goes through.
- Member: read only, like in the dashboard. Changes get
... is a member now, and members can only view, and so do AI agents using the key. - Left the organization: no changes; it can still read until revoked, so revoke it. Settings → API keys marks these keys.
- Role can't be confirmed: nothing changes; try again in a minute.
rowsafe logout and cancelling a request always work. AI agents using a key (local rowsafe mcp or the remote MCP endpoint) act as its person.
Audit log
Every change is recorded: who, what, and where. See Settings → Audit log, or:
rowsafe audit # newest first
rowsafe audit --limit 200WHEN ACTOR ACTION TARGET DETAIL
2026-09-24 14:05:12 key:key_... (CLI · rowsafe CLI on laptop) restore_point.create app before-migration-42AI agents' changes read like [email protected] through their AI agent Claude. The installer's read like installer on db-1.
It records, among others: databases added, changed and removed; hosts changed and removed; enrollment tokens created; tasks queued (backups, Proof runs, plans, restarts); Marks; forks (database.fork); Rewind (rewind.copy, rewind.copy_extend, rewind.copy_delete, rewind.compare, rewind.rows, rewind.in_place, rewind.undo, rewind.cleanup); API keys created and revoked; alerts acknowledged; alert rules and notification channels changed; plan changes; letting an app or key act as you; what AI agents may do; and CLI logins approved or denied.