Team and access control

Org membership controls who can operate floo. Access mode controls who can open your app. accounts requires Pay as you go or above.

1. Manage your floo team

Organization membership controls who can operate apps and billing for your org.

floo orgs members list
floo orgs members set-role <user-id> admin
floo orgs members set-role <user-id> member
floo orgs members set-role <user-id> viewer

Invite a teammate with floo orgs invite <email> --role <admin|member|viewer> (default member); the role applies on acceptance. The dashboard Team page also sends invites and manages pending ones.

2. Choose an app access mode

access_mode is set in floo.app.toml; the next git push applies it.

[app]
name = "my-app"
access_mode = "accounts"

Available modes:

public: open access (default)
accounts: per-user auth via gateway-managed sign-in (Pay as you go+)

For program access, set access = "api_key" on a route. See App API keys and request history. Enterprise SSO (SAML/OIDC) is a sales-assisted setup, not a self-serve access_mode value. Contact sales if you need it.

Where the value lives

[app] access_mode is the default for every environment. [environments.<env>] access_mode overrides it for dev, prod, or preview:

[app]
name = "my-app"
access_mode = "public"

[environments.prod]
access_mode = "accounts"

Each deploy freezes one mode per environment and applies the target environment’s mode when it goes live, so a dev deploy never changes prod. Push, release, and promote apply a change from accounts to public unless your org or app has an approval policy that gates access broadening; then only an authenticated floo redeploy can loosen dev. The CLI rejects access_mode inside [services.web]; the deploy parser ignores that misplaced key with a warning. Put it under [app] or [environments.<env>].

3. Work with password-protected apps

Shared-password access was retired in platform release v2026.10.07.1. Use accounts for per-user sign-in or app API keys for program access.

4. Manage named app users

An accounts app admits only people with an app membership. Manage invitations and members:

floo apps invite teammate@example.com --role member --app my-app
floo apps invites --app my-app
floo apps members --app my-app
floo apps member-role <membership-id> admin --app my-app
floo apps member-remove <membership-id> --app my-app

The sign-in policy is set under [auth] in floo.app.toml; the next deploy applies it to the target environment:

[auth]
access_policy = "domain"   # invite (default), domain, or open

floo accepts all three values, but admission is invitation-only under each: only people with an active app membership get in. domain and open admit no one by email domain or self-signup. Push, release, and promote apply a looser access_policy unless your org or app has an approval policy that gates access broadening; then only an authenticated floo redeploy can loosen dev. The dashboard’s App → Access tab manages the same invitations and members.

5. See users across the org

The org-level Users page lists everyone with an active membership in your apps, with:

which apps they belong to
when access was first granted
user search

What to use where

Task	Config	CLI	Dashboard
change org member roles	no	yes	yes
invite org teammates	no	yes	yes
set the app access mode per environment	`[app]`, `[environments.<env>]`	via `floo redeploy`	no
set the sign-in policy (`invite`, `domain`, `open`)	`[auth] access_policy`	via `floo redeploy`	no
manage explicit app invitations and members	no	yes	yes
inspect org app users	no	no	yes

Get started

Build with your stack

Deploy

Managed services

Environments

Operate

Access

For agents

Team and access control

1. Manage your floo team

2. Choose an app access mode

Where the value lives

3. Work with password-protected apps

4. Manage named app users

5. See users across the org

What to use where

What to do next

Access modes

Budget controls

​1. Manage your floo team

​2. Choose an app access mode

​Where the value lives

​3. Work with password-protected apps

​4. Manage named app users

​5. See users across the org

​What to use where

​What to do next

Access modes

Budget controls

1. Manage your floo team

2. Choose an app access mode

Where the value lives

3. Work with password-protected apps

4. Manage named app users

5. See users across the org

What to use where

What to do next