> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kiwiflow.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Team, keys and billing

> Invite members, set project roles, issue MCP and checker keys, add external references, and choose a plan.

## Organization members

Signing up at [kiwiflow.io/sign-up](https://kiwiflow.io/sign-up) creates your organization and a project named **My first project**. You are the organization's Admin.

An organization Admin invites people from **Members** in the sidebar. Accepting an invitation makes someone an organization member, but it does not give them access to any project. A project Admin adds them to each project they need.

Organization roles and project roles are separate. An organization Admin does not automatically get access to every project, and a project Admin does not get billing access.

## Project roles

A project Admin adds organization members to a project and sets their role in the project's **Members** tab.

| Role | What they can do |
| - | - |
| Admin | Manage the project: workflows, skills, members, keys and connections. Do any workflow step that allows Admins. |
| Contributor | Do workflow steps that allow Contributors. In Development: Plan, Implement and Handoff. |
| Reviewer | Do workflow steps that allow Reviewers. In Development: Plan, Verify, Independent review, Human acceptance and Handoff. |

A project Admin can also copy a member's user ID from the **Members** tab. An agent needs it to name a person as a check reporter or approver.

## MCP keys

Most agents sign in with OAuth and need no key; see the [Quickstart](https://docs.kiwiflow.io/quickstart.md#connect-your-agent). Use an MCP key for a client that cannot sign in with OAuth but can send an `Authorization` header.

A project Admin issues MCP keys on the **Agents** page. Choose a project, a name, the access level (read or write), and an expiry of 1, 7, 30 or 90 days. The secret is shown once: copy it into your client's credential store straight away. Send it with every request:

```http theme={null}
Authorization: Bearer YOUR_MCP_KEY
```

* **Read** keys can call the [read tools](https://docs.kiwiflow.io/remote-mcp.md#read-tools).
* **Write** keys can also call the [write tools](https://docs.kiwiflow.io/remote-mcp.md#write-tools).

A key works only for its project. It acts as the Admin who issued it. It stops working when it expires or is revoked, or when that Admin leaves the organization or loses access to the project; calls then return `403 forbidden`. A key cannot make decisions, report checks or change settings.

If you lose a secret, revoke the key and issue a new one. Kiwi cannot show a secret again.

## Checker keys

A checker key lets a CI pipeline report check results through the [checker API](https://docs.kiwiflow.io/ci-reporting.md). It can read the check context of a run where it is assigned a check, and report that check. It cannot do anything else.

A project Admin creates checker keys in the project's **Connections** tab. Choose a name, the check IDs the key may report, and an expiry of 1, 7, 30 (the default) or 90 days.

* **Secret.** It is shown once, when the key is created. Store it in your CI secret manager straight away. Retrying the same request returns the key without its secret and does not create another key.
* **Reporter ID.** It looks like `checker:…` and is shown on the key. Use it in a plan's `authorizedReporterIds`. It is not the same as the key's record ID.
* **Lifetime.** The key stops working when it expires or is revoked, or when the Admin who created it leaves the organization or loses access to the project. Rotate it before it expires.

## External references

The **Connections** tab also holds references to outside resources, such as a test site or a dashboard, for people and agents to find. Agents read them with `list_connections`.

A project Admin adds a name, a URL, notes, and optional bindings to workflow steps. Each binding names a `workflow_id`, `workflow_revision` and `step_id`.

* The URL must be a public `https` address with no username, password, query string or fragment. Private and local addresses are rejected. Never put a token in a reference.
* Kiwi does not call the URL or check that it works.
* Archived references stay in the project's history.

## Plans and billing

Plans are priced per organization per month in USD, billed monthly.

| Plan | Price | Members | Workflows |
| - | - | - | - |
| Free | \$0 | 1 | Up to 3 |
| Starter | \$30 per month | Up to 5 | Unlimited |
| Business | \$200 per month | Unlimited | Unlimited |
| Enterprise | Custom | By agreement | By agreement |

**Workflows** counts the different workflow IDs published across all of the organization's projects. The same workflow ID published in several projects counts once, and publishing a new revision of an existing workflow is always allowed.

An organization Admin changes the plan from **Billing** in the sidebar.

When your organization reaches a limit, Kiwi blocks the action until an Admin upgrades:

* Publishing a workflow ID beyond your plan's limit returns `403 plan_limit_reached`.
* You cannot add members beyond your plan's member limit.

## Referrals

An organization Admin can create a referral link in **Referrals** and see how many new organizations signed up through it. A referral counts only for a new organization created within 30 days of opening the link.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.