Skip to main content

How to manage users in Temporal Cloud

How to invite users to your Temporal Cloud account​

When you create a user in Temporal Cloud, the prospective user receives an email invitation. Before accepting the invitation, the user must be logged in to the email address that received the invitation. The user must then select Accept Invite in the message. Attempting to log in to Temporal Cloud without first accepting the invite doesn't work.

info

To invite users, a user must have the Global Admin account-level Role.

Roles and permissions​

Each user in Temporal Cloud is assigned a Role. Each user can be assigned permissions for individual Namespaces.

How to invite users using Web UI​

  1. In Temporal Web UI, select Settings in the left portion of the window.
  2. On the Settings page, select Create Users in the upper-right portion of the window.
  3. On the Create Users page in the Email Addresses box, type or paste one or more email addresses.
  4. In Account-Level Role, select a Role. The Role applies to all users whose email addresses appear in Email Addresses.
  5. If the account has any Namespaces, they are listed under Grant access to Namespaces. To add a permission, select the checkbox next to a Namespace, and then select a permission. Repeat as needed.
  6. When all permissions are assigned, select Send Invite.

Temporal sends an email message to each user. To join Temporal Cloud, a user must select Accept Invite in the message.

How to invite a user using tcld​

For details, see the tcld user invite command.

Temporal sends an email message to the specified user. To join Temporal Cloud, the user must select Accept Invite in the message.

What are the account-level Roles for users in Temporal Cloud?​

When a Global Admin invites a user to join an account, the Global Admin selects one of the following Roles for that user:

  • Global Admin
    • Has full administrative permissions across the account, including users and usage
    • Has Namespace Admin permissions on all Namespaces in the account
  • Developer
    • Can create and update Namespaces; has full control over Workflows
    • Has Namespace Admin permissions for each Namespace created by that user
  • Read-Only: Can only read information

What are the Namespace-level permissions for users in Temporal Cloud?​

A Global Admin can assign permissions for any Namespace in an account. A Developer can assign permissions for a Namespace they create.

For a Namespace, a user can have one of the following permissions:

  • Namespace Admin: Can create and edit Namespaces; can create, rename, update, and delete Workflows
  • Write: Can create, rename, update, and delete Workflows within the Namespace
  • Read-Only: Can only read information from the Namespace

How to update an account-level Role in Temporal Cloud​

You can update the account-level Role for a user by using either Web UI or tcld.

info

To update an account-level Role, a user must have the Global Admin account-level Role.

How to update an account-level Role using Web UI​

  1. In Temporal Web UI, select Settings in the left portion of the window.
  2. On the Settings page, select the user.
  3. On the user profile page, select Edit User.
  4. On the Edit User page in Account Level Role, select the Role.
  5. Select Save.

How to update an account-level Role using tcld​

For details, see the tcld user set-account-role command.

How to update Namespace-level permissions in Temporal Cloud​

You can update Namespace-level permissions by using either Web UI or tcld.

How to update Namespace-level permissions for a Namespace using Web UI​

  1. In Temporal Web UI, select Namespaces in the left portion of the window.
  2. On the Namespaces page, select the Namespace.
  3. If necessary, scroll down to the list of permissions
  4. On the user profile page in Namespace permissions, select the Namespace.
  5. On the Namespace page in Account Level Role, select the Role.
  6. Select Save.

How to update Namespace-level permissions for a user using Web UI​

note

A user who has the Global Admin account-level Role has Namespace Admin permissions for all Namespaces.

  1. In Temporal Web UI, select Settings in the left portion of the window.
  2. On the Settings page in the Users tab, select the user.
  3. On the user profile page, select Edit User.
  4. On the Edit User page in Namespace permissions, change the permissions for one or more Namespaces.
  5. Select Save.

How to update Namespace-level permissions using tcld​

For details, see the tcld user set-namespace-permissions command.

How to delete a user from your Temporal Cloud account​

You can delete a user from your Temporal Cloud Account by using either Web UI or tcld.

info

To delete a user, a user must have the Global Admin account-level Role.

How to update an account-level Role using Web UI​

  1. In Temporal Web UI, select Settings in the left portion of the window.
  2. On the Settings page, find the user and, on the right end of the row, select Delete.
  3. In the Delete User dialog, select Delete.

You can delete a user in two other ways in Web UI:

  • User profile page: Select the down arrow next to Edit User and then select Delete.
  • Edit User page: Select Delete User.

How to update an account-level Role using tcld​

For details, see the tcld user delete command.