Roles & permissions

Before your engineers can request live API tokens, someone with the right role has to grant them. This page is about the dashboard, not the API.

Dashboard prerequisite

Only users with Owner or Admin privileges can create Developer Applications, issue API keys, or view webhook secrets. If those options are greyed out for you, you have the Developer or Analyst role — ask an Owner to either grant you Admin or issue the key on your behalf.

The roles

Role	Can issue API keys	Can view webhook secrets	Can send test notifications	Can read analytics	Can manage members
Owner	Yes	Yes	Yes	Yes	Yes
Admin	Yes	Yes	Yes	Yes	Yes, except Owners
Developer	No	No	Yes	Yes	No
Analyst	No	No	No	Yes	No

There is exactly one Owner per workspace at creation. Transferring ownership is an Owner-only action.

Assigning a role

1. Log into app.nervly.io.
2. Go to Settings → Team.
3. Invite by email address, or change an existing member's role from the row menu.
4. Select the role the member needs.

A role change takes effect on the member's next page load. It does not revoke API keys they already created — see below.

How roles relate to API keys

This is the part that catches people out.

Revoking a role does not revoke their keys

An API key is scoped to the workspace, not to the person who created it. If a Developer leaves and you remove them from the team, any key they issued keeps working until you revoke the key itself.

When someone with key-issuing rights leaves, audit Settings → Developer Applications and revoke anything they created. Rotating is safe — create the replacement, deploy it, then revoke the old one, so there is no window where in-flight requests fail. See Managing API keys.

The same applies in reverse: a key is not bound to the role of whoever created it. An Admin can issue a read-only key, and that key can inspect the workspace without being able to send. What a key can do comes from the scopes set on the key itself, not from the role of its creator. See Managing API keys.

What roles do not control

Roles govern the dashboard. They are not the same thing as API key scopes, and one does not determine the other. Every key carries read and/or write scopes; leaving the choice out grants both, and write implies read.

• A read-only key (read) can call the diagnostic and read endpoints — delivery status, message, template and subscriber lookups — and the read-only MCP tools: gateway_status, idempotency_inspect, check_delivery_status, list_templates and verify_subscriber_channel.
• A read-only key cannot trigger events, run bulk sends, update subscriber preferences or delete subscribers.
• A read-write key (read and write, the default) can do everything above and send.
• There is no key restricted to a single channel or a single workflow, and no per-endpoint permission beyond the read/write split.

If you need finer control than that, put your own service in front of Nervly and enforce it there.

Next

• Managing API keys — creating, scoping and rotating
• Authentication — how keys are presented on the wire