> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hud.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Team settings

> Manage team access, API keys, rollout secrets, provider credentials, usage, billing, and spend limits.

Your active **team** is the isolation boundary for platform resources, credentials, usage, and
billing. API requests are authorized as one membership within that team, even though the
corresponding platform routes use `/project`.

## Roles and access

| Role                      | Typical access                                                                |
| ------------------------- | ----------------------------------------------------------------------------- |
| **Team admin**            | Manage members, billing, team credentials, shared data, and team-wide limits. |
| **Team member**           | Work with team resources and manage personal credentials and files.           |
| **External collaborator** | Access explicitly shared resources and personal files.                        |

Sharing an environment, taskset, job, or trace grants access to that resource. It does not move the
resource to another team or expose unrelated credentials and data.

## API keys

A `HUD_API_KEY` authenticates the CLI, SDK, REST API, Platform MCP, and inference gateway. Each key
belongs to a membership and its active team, so usage and limits can be attributed to the person or
automation that used it.

Open [API Keys](https://hud.ai/project/api-keys) to:

* create a named key with an optional expiration
* copy its value when it is created
* rename or revoke a key
* inspect month-to-date inference spend
* attach a weekly or monthly spend limit

The full key value is shown once. Revoking it stops new authenticated requests immediately. Team
admins can also create keys for another member and inspect team key ownership.

## Choose the right secret scope

| Credential store          | Scope                                                           | Use it for                                                  |
| ------------------------- | --------------------------------------------------------------- | ----------------------------------------------------------- |
| **Environment variables** | One environment, shared with its editors                        | Credentials and configuration required by that environment. |
| **Personal secrets**      | One membership, injected into every rollout sandbox it launches | Values the member's sandbox workloads may access.           |
| **BYOK credentials**      | Personal or team provider route                                 | Provider API keys used by eligible inference requests.      |

Do not put a provider key in personal secrets when the inference gateway should own and meter the
provider call. Use **BYOK** for that path. Use an environment variable when the task itself must
call an external service.

## Usage and billing

**Usage** separates inference spend from environment runtime and lets admins inspect team-wide
attribution. A job also has its own Usage tab for the cost of that evaluation.

**Billing** is admin-only. It manages the subscription, credit balance, payment methods, and
automatic top-ups. Platform and model availability can depend on the team's plan and enabled
features.

## Spend limits

Limits can apply to the whole team, one membership across all of its keys, or one API key.

| Action    | Behavior                                                                            |
| --------- | ----------------------------------------------------------------------------------- |
| **Alert** | Email the configured recipients after spend crosses the amount.                     |
| **Block** | Refuse new inference requests and environment sessions after the amount is reached. |

Each limit uses a UTC calendar week or month. When several blocking limits apply, the tightest one
wins. Existing runs are not retroactively changed, and no limit is enabled by default.

API authentication formats are under [REST API](/platform/rest-api#authentication) and
[Platform MCP](/platform/mcp#authentication).