Accounts, users and roles

Four words carry the whole account model, and each has one meaning everywhere: in the dashboard, in ribo, over the REST API and through MCP. This page defines them. The pages after it cover each surface in depth.

The four words

Word	Meaning
User	Your sign-in: one email address, a password, and two-factor authentication if you turn it on. A user owns nothing. Everything you deploy belongs to an account.
Account	The container resources belong to: Cells, c3 databases, g7 buckets, custom domains, vault values, API tokens, billing, and the activity feed. Every account is the same kind of thing. There is no personal edition and no team edition; any account can hold one person or many.
Membership	The link between a user and an account. One user can belong to many accounts, and one account can hold many users.
Role	What a membership allows: owner, admin or developer. The role rides in every session and API token as a signed claim, and the platform caps the credential's scopes to it on every request. Members and roles has the ceilings.

An account has three identifiers, shown under Account → Overview:

Identifier	What it is
Name	A label, up to 100 characters. An owner can change it at any time, and renaming changes no URL.
Id	`acct_<16 hex>`. Never changes. The value `ribo account pin` writes into `ribo.toml`.
Subdomain	`<word>-<hex>`, derived from the id. The account's Cells are served as `<cell>.<subdomain>.tissue.dev`.

Resource names are scoped to the account: two accounts can each have a database, a bucket or a Cell called myapp, and they are unrelated.

Signing up

Signing up does three things in one step: it creates your user, creates one account, and makes you that account's owner. The sign-up form's workspace name field is the account's name; left blank, the account is called <local-part>'s workspace, after the part of your address before the @. Change it later from Account → Overview.

The account created at sign-up is not a special kind. It takes members, it can be renamed, left or closed, on the same terms as an account created later from the dashboard.

If the address is already registered, sign-up answers "That email address is already signed up. Sign in instead." What exists is a user, and signing in as it is the way to reach every account that user belongs to.

Joining an account

A second person joins an account by invitation, never by signing up into it. An owner or admin sends an invite to an email address with a role of admin or developer. The link works for seven days and only for a session signed in as that address, so someone who is not signed up yet signs up first, with the same address, then opens the link. Accepting adds a membership and switches the session onto the new account. The full rules are under inviting someone.

Ownership is not granted over the API or the dashboard. An account gets its owner at sign-up, and ownership moves by hand through support.

Which account you are acting on

A session is always on exactly one account. Signing in lands you on your oldest membership, which for anyone who signed up here is the account created then. Switching is explicit and re-issues the session at the role you hold on the account you switch to:

Surface	How
Dashboard	Account → Overview → Your accounts
`ribo`	`ribo account whoami` to check, `ribo account switch <name-or-id>` to change. A profile binds a directory to one credential, and the account pin aborts a deploy aimed at the wrong account.
API tokens	A `tok_` token is minted on one account and acts there only.

A user whose last membership is gone is not stranded: the next sign-in creates a fresh account for them, named <local-part>'s workspace, with them as owner.

Leaving and closing

Leaving an account removes your membership and nothing else. The account and everything in it stay. Anyone can leave without an administrative role; an owner hands ownership over first.

Closing an account destroys it and everything it owns, after a seven-day grace period any owner can cancel. Only an owner can close an account. A user whose only membership was the closed account is deleted with it, and can sign up again with the same address. The full sequence is on closing an account.