Documentation

Permissions

Control access to your Flipper Cloud organization, projects, and environments with role-based permissions.

Overview

Flipper Cloud provides role-based access control at three levels: organization, project, and environment. On free plans, all team members are administrators with full access. Paid plans unlock granular permissions so you can restrict access as your team grows.

Organization Roles

Every organization member has one of three roles:

• Admin — Full control over the organization, including billing, projects, environments, team members, and features.
• Member — Can view projects and manage features according to each environment's permissions. Cannot invite team members or manage organization settings.
• Billing — Can only manage subscription and billing information. Cannot access projects or features.

On free plans, new members default to the admin role. On paid plans with advanced permissions, new members default to the member role.

Every organization must have at least one admin.

Project Collaborators

Organization members automatically have access to all projects in the organization. You can also grant access to people outside your organization by adding them as project collaborators.

Collaborators can view and manage features in the projects they're added to, but they don't have access to other projects or organization settings.

On paid plans, organization admins can promote project collaborators to full organization members.

Environment Permissions

Each environment can be configured to control who can enable, disable, and rollback feature flags:

• All project members (default) — Anyone with access to the project can modify features in this environment.
• Organization members only — Only organization members can modify features. Project collaborators can view but not change feature state.
• Environment owners only — Only hand-picked environment owners can modify features. Everyone else can view but not change feature state.

Environment permissions apply to enabling, disabling, and rolling back feature flags. Viewing feature state is available to all project members regardless of the environment's permission setting.

Personal environments are always controlled exclusively by the person they belong to.

Trusted Domains

Organization admins on supported plans can configure trusted domains for automatic team provisioning. When a user signs in with Google using an email address from a verified domain, they're automatically added to the organization.

To set up a trusted domain:

1. Go to your organization's settings.
2. Add your domain and select the default role for new members.
3. Verify ownership by adding a DNS TXT record.

Once verified, anyone signing in with a matching email domain is automatically added to your organization with the configured role, as long as seats are available.