Restrict Project Access to Invited Members

Every project in a Tenderly organization has an Access setting with two options: open to all organization members, or restricted to an explicitly invited member list. A restricted project is visible only to its members, and API requests to it require a project token. Access is configured in three places: the Create Project dialog, the Configure action on the organization’s Projects page, and the project’s Settings page.

​

Project access options

• All members: everyone in the organization has access, including all global tokens. This is the default and matches the behavior projects had before access control was introduced.
• Only invited members: only members you add have access, and API access requires a project token.

Access controls membership only. What a member can do inside a project is still defined by their organization-level permissions; adding someone to a project does not grant additional permissions.

​

Create a restricted project

1. On the organization’s Projects page, click Create Project.
2. Enter a project name. The URL preview updates as you type; the project slug cannot be changed later.
3. Under Access, select Only invited members. A member picker appears.
4. Use Add members to search organization members and add them to the project. The organization owner and you are on the list by default and cannot be removed.
5. Click Create Project.

Because global tokens cannot reach a restricted project, the dialog then offers to create the project’s first project token. Set a name and an optional expiration date, then click Create Token, or click Create later and create one from project settings when you need API access.

​

Restrict an existing project

1. On the organization’s Projects page, open the project’s row menu and select Configure. The same controls are available in the project’s Settings.
2. Under Access, select Only invited members.
3. Review the warning: it states how many global tokens lose access to this project. Those tokens keep working everywhere else, and project tokens are unaffected. If your integrations use global tokens against this project, create a project token for them before you confirm.
4. Adjust the member list, then click Update.

When you restrict an existing project, all current organization members are added as project members, so nobody loses access unexpectedly. Remove the members who should not have access after the switch.

​

Open a restricted project to all members

Select All members in the project’s Configure dialog or Settings. Global tokens gain access to the project; existing project tokens keep working, still scoped to that project only. Nothing breaks when a project is opened up.

​

Manage project members

Add or remove members from the Access section of the project’s Settings or the Configure dialog. The member list shows each member’s name and email, with Owner and You badges. The organization owner cannot be removed. Adding or removing project members never affects access tokens. Tokens react only to the project switching between restricted and all-members access.

​

Who can manage project access

• Changing a project’s access and managing its members requires the Update projects permission.
• Organization admins keep access to every project, including restricted ones, and are members of every restricted project.
• Creating an access token for a restricted project additionally requires membership in that project. See access tokens.

​

What non-members see

For organization members who are not on a restricted project’s member list, the project does not exist anywhere in the dashboard:

• It does not appear in the organization’s Projects page, the project switcher, or search.
• Opening the project’s URL directly shows the no-permission page.
• API requests return 404 Project not found. Personal access tokens have no access to restricted projects. See access token scopes.

The organization’s Projects page shows each project’s access at a glance: open projects show All members in the Access column, while restricted projects show the avatars of their members.