Skip to main content

​
Organization members

Signing up at kiwiflow.io/sign-up creates your organization and a project named My first project. You are the organization’s Admin. An organization Admin invites people from Members in the sidebar. Accepting an invitation makes someone an organization member, but it does not give them access to any project. A project Admin adds them to each project they need. Organization roles and project roles are separate. An organization Admin does not automatically get access to every project, and a project Admin does not get billing access.

​
Project roles

A project Admin adds organization members to a project and sets their role in the project’s Members tab. A project Admin can also copy a member’s user ID from the Members tab. An agent needs it to name a person as a check reporter or approver.

​
MCP keys

Most agents sign in with OAuth and need no key; see the Quickstart. Use an MCP key for a client that cannot sign in with OAuth but can send an Authorization header. A project Admin issues MCP keys on the Agents page. Choose a project, a name, the access level (read or write), and an expiry of 1, 7, 30 or 90 days. The secret is shown once: copy it into your client’s credential store straight away. Send it with every request:
A key works only for its project. It acts as the Admin who issued it. It stops working when it expires or is revoked, or when that Admin leaves the organization or loses access to the project; calls then return 403 forbidden. A key cannot make decisions, report checks or change settings. If you lose a secret, revoke the key and issue a new one. Kiwi cannot show a secret again.

​
Checker keys

A checker key lets a CI pipeline report check results through the checker API. It can read the check context of a run where it is assigned a check, and report that check. It cannot do anything else. A project Admin creates checker keys in the project’s Connections tab. Choose a name, the check IDs the key may report, and an expiry of 1, 7, 30 (the default) or 90 days.
  • Secret. It is shown once, when the key is created. Store it in your CI secret manager straight away. Retrying the same request returns the key without its secret and does not create another key.
  • Reporter ID. It looks like checker:… and is shown on the key. Use it in a plan’s authorizedReporterIds. It is not the same as the key’s record ID.
  • Lifetime. The key stops working when it expires or is revoked, or when the Admin who created it leaves the organization or loses access to the project. Rotate it before it expires.

​
External references

The Connections tab also holds references to outside resources, such as a test site or a dashboard, for people and agents to find. Agents read them with list_connections. A project Admin adds a name, a URL, notes, and optional bindings to workflow steps. Each binding names a workflow_id, workflow_revision and step_id.
  • The URL must be a public https address with no username, password, query string or fragment. Private and local addresses are rejected. Never put a token in a reference.
  • Kiwi does not call the URL or check that it works.
  • Archived references stay in the project’s history.

​
Plans and billing

Plans are priced per organization per month in USD, billed monthly. Workflows counts the different workflow IDs published across all of the organization’s projects. The same workflow ID published in several projects counts once, and publishing a new revision of an existing workflow is always allowed. An organization Admin changes the plan from Billing in the sidebar. When your organization reaches a limit, Kiwi blocks the action until an Admin upgrades:
  • Publishing a workflow ID beyond your plan’s limit returns 403 plan_limit_reached.
  • You cannot add members beyond your plan’s member limit.

​
Referrals

An organization Admin can create a referral link in Referrals and see how many new organizations signed up through it. A referral counts only for a new organization created within 30 days of opening the link.