# Organization

Source: https://docs.getworg.com/organization

Who can do what in your organization, how workspaces split keys and budgets, and how to protect your account.

## Roles

An organization has three roles: owner, admin and member. It always keeps at least one owner.

| Action | Who |
| --- | --- |
| Change roles | Owner, with a two-step code |
| Set the organization's monthly budget | Owner |
| Invite members | Owner or admin. Only an owner adds another owner. |
| Remove members | Owners remove anyone, admins remove members. Anyone can leave. |
| Organization settings, low-balance email, combos | Owner or admin |
| Review, rotate or resume a suspended key | Owner or admin. Resume needs a two-step code. |
| Credits ledger, monthly statements, referrals | Owner or admin |
| Top up | Everyone. Members see only their own orders. |
| Usage | Everyone, for the whole organization |
| Create keys | Everyone. Members get the default limits. |

Removing someone revokes the keys they created, and the owners get an email about it.

## Workspaces

- Every organization has a Default workspace. It uses the organization's limits and cannot be archived.
- Other workspaces can have a monthly budget, up to the organization's budget, and their own requests-per-minute and tokens-per-minute limits.
- A key's budget cannot be higher than its workspace's budget or the organization's budget.
- Archiving a workspace revokes every key in it. It cannot be undone.

In each workspace a person is an admin or a developer. Owners and admins of the organization are admins everywhere. A developer creates keys with the default limits and manages only their own keys. Every member is a developer in Default.

## Two-step verification

Two-step verification uses an authenticator app. It is optional, and recommended for owners and admins once the organization has a balance. Three actions need it:

- Resuming a suspended key
- Changing a member's role
- Making new recovery codes

Turn it on in Account. You get 10 recovery codes, shown once. A recovery code works for signing in, but not for the three actions above. If you lose both your authenticator and your codes, write to [team@getworg.com](mailto:team@getworg.com).

Next: [Billing](https://docs.getworg.com/billing) · [Authentication](https://docs.getworg.com/authentication)