Account Management

Overview

Trix accounts support multiple users with role-based access control. You can invite team members, assign roles, and manage permissions—all within a single account that shares spaces, API keys, and billing.

This page covers Trix's built-in team features. If you're building a multi-tenant application where your end-users each need isolated data, see the Multi-User Apps guide instead.

Account Structure

Trix uses a hierarchical structure for organization:

• Account — The top-level organization. Contains users, spaces, API keys, and billing.
• Users — Individual team members who can sign in with email/password.
• Spaces — Isolated workspaces within an account. Users access spaces via API keys.
• API Keys — Credentials for programmatic access, scoped to specific spaces.

User Roles

Each user has a role within an account that determines their permissions:

Inviting Team Members

Owners and admins can invite new users to the account. Invitations are sent via email and expire after 7 days by default.

Using the CLI

# Invite a new team member
trix account invite [email protected] --role member

# Invite as admin
trix account invite [email protected] --role admin

# List pending invitations
trix account invites

# Revoke a pending invitation
trix account invite revoke <invite-id>

Using the REST API

# Send an invitation
curl -X POST https://api.trixdb.com/v1/accounts/invites \
  -H "Authorization: Bearer $TRIX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "[email protected]",
    "role": "member"
  }'

# List pending invitations
curl https://api.trixdb.com/v1/accounts/invites \
  -H "Authorization: Bearer $TRIX_API_KEY"

When the recipient accepts the invitation, they'll either:

• Create a new Trix account (if they don't have one)
• Be added to your account (if they already have a Trix login)

Managing Members

View, update, and remove team members from your account.

Using the CLI

# List all members
trix account members

# Change a member's role
trix account member update <user-id> --role admin

# Remove a member
trix account member remove <user-id>

Using the REST API

# List all members
curl https://api.trixdb.com/v1/accounts/members \
  -H "Authorization: Bearer $TRIX_API_KEY"

# Update a member's role
curl -X PATCH https://api.trixdb.com/v1/accounts/members/<user-id> \
  -H "Authorization: Bearer $TRIX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"role": "admin"}'

# Remove a member
curl -X DELETE https://api.trixdb.com/v1/accounts/members/<user-id> \
  -H "Authorization: Bearer $TRIX_API_KEY"

Switching Accounts

Users who belong to multiple accounts can switch between them. This is useful for:

• Consultants working with multiple clients
• Developers with personal and work accounts
• Agencies managing multiple organizations

Using the CLI

# List accounts you belong to
trix account list

# Switch to a different account
trix account switch <account-id>

# Show current account
trix account current

Using the REST API

# List your accounts (requires JWT auth, not API key)
curl https://api.trixdb.com/v1/auth/accounts \
  -H "Authorization: Bearer $JWT_TOKEN"

# Switch account (returns new JWT for that account)
curl -X POST https://api.trixdb.com/v1/auth/switch-account/<account-id> \
  -H "Authorization: Bearer $JWT_TOKEN"

Transferring Ownership

Account ownership can be transferred to another admin or member. Only the current owner can initiate a transfer.

# Transfer ownership (CLI)
trix account transfer-ownership <user-id>

# Transfer ownership (API)
curl -X POST https://api.trixdb.com/v1/accounts/members/<user-id>/transfer-ownership \
  -H "Authorization: Bearer $TRIX_API_KEY"

API Key Access Control

API keys can be scoped to specific spaces with different permission levels:

# Create an API key with space-specific access
trix keys create --name "production-reader" \
  --space prod-space --permission read

# Grant a key access to additional spaces
trix keys grant <key-id> --space staging-space --permission read_write

# Delete a key
trix keys delete <key-id>

# Create an account-admin key (full access to all spaces)
trix keys create --name "admin-key" --account-admin

Audit Logging

Trix maintains audit logs for account management actions. These logs help with:

• Security investigations
• Compliance requirements
• Understanding who made changes and when

Audited actions include:

• User invitations sent, accepted, and revoked
• Role changes
• Member additions and removals
• Ownership transfers
• API key creation and deletion

Best Practices

• Use the principle of least privilege — Assign the minimum role needed. Most team members should be "member" not "admin".
• Create space-scoped API keys — Avoid account-admin keys in production. Scope keys to specific spaces.
• Rotate API keys regularly — Delete unused keys and create new ones periodically.
• Document your account structure — Keep a record of who has access and why.
• Review members periodically — Remove access for people who no longer need it.

Next Steps

• CLI Account Commands — Full reference for account management commands
• API Key Management — Detailed guide to creating and managing API keys
• Multi-User Apps Guide — Build applications with per-user data isolation
• Security — Security architecture and best practices