> ## Documentation Index
> Fetch the complete documentation index at: https://docs.b3iq.org/llms.txt
> Use this file to discover all available pages before exploring further.

# Organizations

Team workspaces for the B3IQ dashboard and gateway, with shared settings, members, and org-scoped keys.

A B3IQ account can belong to more than one organization. The active
organization scopes everything you do in the dashboard and through the
gateway key manager: the keys you can create, view, update, and revoke.
Settings and Members are shared across both the inference and operator views
of a single organization, so a team sees one workspace, not two.

You switch organizations from the account menu in the dashboard. Authenticated
gateway requests carry the active organization on the `X-Org-ID` header.

## Create or switch an organization

**Open the account menu**

Select your account in the top-right of the dashboard. The menu lists every
    organization you belong to and marks the one that is currently active.
  **Switch organizations**

Choose another organization to make it active. Gateway keys in the
    dashboard immediately reflect the selected organization.
  **Create a new organization**

Choose New organization, give it a name, and confirm. You become its first
    member with full access, and it becomes the active organization.
  **Invite members**

Open Settings, then Members, to invite teammates by email and assign each a
    role. Members and Settings are shared across the inference and operator
    views of the organization.

## Roles

Members hold a role within an organization: **Admin**, **Developer**,
**Operator**, or **Viewer**. Each role carries a preset bundle of
capabilities: adding machines to the org, managing machines (commands,
routing, model/runtime install, the browser terminal, the SSH lane toggle),
SSH access to org machines, free inference routed to the org's machines,
reading and managing the org's gateway keys, viewing the org's earnings, and
managing members. An Admin can override individual capabilities per member.
Manage roles under Settings, then Members.

The server enforces the limits the page shows: it refuses to demote or remove
the last Admin, and refuses to let anyone remove themselves. Creating,
updating, or revoking an organization's gateway keys requires the
`keys.manage` capability (Admin and Developer by default); reading the key
list only needs `keys.read`, which every role holds. Viewing the org's
earnings requires `earnings.view`, which is Admin-only by preset.

## What is org-scoped

Gateway keys created while an organization is active are owned by that
organization for dashboard management. Moving to a different organization
changes the key set you see and act on.

| Resource | Scope |
| --- | --- |
| ` Gateway keys ` | Created in and managed by the active organization |
| ` Usage ` | Currently recorded against the customer account that owns the key |
| ` Usage & quotas ` | Rate limits and the daily token quota apply per customer account |
| ` Machines ` | Can be claimed directly by an organization; a member's role and capabilities govern what they can do with org machines (view, SSH, manage models/runtimes, add new machines) |
| ` Earnings ` | Visible to members holding earnings.view (Admin by preset) |
| ` Members & roles ` | Shared across the inference and operator views of the organization |
| ` Settings ` | Shared per organization across both views |

**X-Org-ID selects the active organization**

Dashboard and key-management API requests send the active organization id on
  the `X-Org-ID` header when a request can resolve to more than one
  organization; the control plane verifies your membership server-side before
  honoring it. Bearer-key inference calls don't use this header. A gateway
  key's routing is decided by how the key itself was created (see below), not
  by the caller's active organization. Gateway usage attribution still follows
  the key's customer account until org-level attribution ships. Read your
  organization id from the account menu or the dashboard Settings page.

## Route to the organization's machines

A gateway key minted while an organization is active can be scoped to route
free inference to that organization's claimed machines, not just your personal
ones. This requires the `inference.free` capability at key-creation time
(granted to Admin, Developer, and Operator by default) and stays
own-nodes-strict: the key only ever dispatches to machines the organization
actually owns, verified server-side on every request.

## Related

**[Hosted Gateway](/developers/hosted-gateway)**

Call OpenAI-compatible endpoints with org-scoped gateway keys.
  **[Receipts & Payouts](/developers/receipts-billing)**

How receipts, usage rows, and payout evidence are recorded.