Organisations
How accounts and organisations relate, creating and switching organisations, the organisation's settings, and leaving one or deleting your account.
FurniOps works like Stripe: one person has one account, and belongs to any number of organisations through a membership with a role. Everything else (catalogues, sources, keys, webhooks, the plan) belongs to an organisation, never to a person.
| Belongs to | |
|---|---|
| Email, password, passkeys, two-step verification, sessions | Your account |
| Catalogue, sources, API keys, OAuth apps, webhooks, plan, audit log | The organisation |
| Your role, and what you may do | Your membership in that organisation |
A member who leaves takes nothing with them: the keys they made keep working until someone revokes them, and their account and other organisations are untouched.
Create an organisation
After signing up you land on your account page with a form to create your first organisation. More can be made from your account page (New organization). The person who creates an organisation is its first owner. An account can belong to up to 100 organisations.
Each organisation has a name (up to 100 characters) and a slug, its name in URLs: lowercase
letters, digits and inner hyphens, 3 to 40 characters, unique, and not a reserved word such as
admin or api.
Switch organisations
Every sign-in, session and token acts in exactly one organisation. In the dashboard, the organisation switcher at the top of the sidebar moves you to another one; behind it, FurniOps issues new tokens for that organisation, so nothing can mix two organisations' data. Your account page lists every organisation you belong to with your role in each.
Through the API, GET /v1/org answers the organisation a
credential belongs to: its ID, name and slug, and its plan with the features it switches on. A
user's token can also list every organisation the user belongs to, with their role in each, with
GET /v1/me/orgs; API keys, machine clients and
support sessions are refused there. Switching organisation means a new token for it.
The organisation's settings
Settings in the dashboard shows the organisation's name and ID, its plan and the features the plan switches on, the other organisations you belong to, and links to your own account. Its tabs reach each part:
| Tab | Page |
|---|---|
| Members | Members and roles |
| Security | The organisation's policies (below), and links to your own account's security (sign-in methods and sessions): Account security |
| SSO | Single sign-on |
| Audit log | Audit log |
| AI agents | Each AI agent's autonomy and daily budget: AI agents |
| Usage | Usage and quotas |
| Billing | The plan, card and invoices: Billing (switched off for now) |
Organisation policies
Settings › Security › Organisation policies holds three security settings. Owners, admins and developers see where each stands; only an owner can Change one.
| Policy | Setting | Choices |
|---|---|---|
| Support access | support_access | allowed (the default) or blocked |
| Agent key approval | agent_key_approval | off (the default) or required |
| Leaked keys | leaked_key_action | revoke (the default) or review |
Behind the dashboard they are fields of PATCH /v1/org, which needs org:write: owners only,
signed in, since no API key or OAuth app can hold it (so it is not in the public
API reference). Changing any of the three needs a sign-in from the last 10
minutes: an older session is refused with 403
reauthentication_required, and the dashboard asks you to
confirm it is you before saving. The same call renames the organisation or changes its slug (a
slug already taken is 409), which needs no recent sign-in; the dashboard has no control for
renaming yet.
Leave an organisation, or delete your account
From your account page:
- Leave an organisation: you lose access to it at once; someone there can invite you again. The last owner cannot leave: make another member an owner first.
- Delete account: permanently deletes your account, its sign-in methods and memberships. Organisations where you are the only member are deleted too. If you are the only owner of an organisation that has other members, make one of them an owner first.
OAuth apps
Register an OAuth app for your organisation, sign members in with the authorization code flow and PKCE, call the API as the organisation with client credentials, and handle scopes, consent, token lifetimes, refresh rotation and secret rotation.
Members and roles
The five built-in roles and exactly what each may do, inviting people, changing roles, removing members, seats, and how a change reaches tokens already issued.