> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qwencloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Team management

> Add and manage team members, assign and revoke seats, configure SSO login, and monitor Credits usage in the Token Plan Management Console.

## Access the Management Console

Go to the [Token Plan subscription page](https://home.qwencloud.com/analytics/token-plan/team) and click **Assign Seats** to enter the Management Console. The console is divided into two sections:

- **Personal**: API Keys, Personal Usage.
- **Organization**: Organization Usage, Members, Settings.

## Roles and permissions

| Role   | Permissions                                                                                                                                |
| ------ | ------------------------------------------------------------------------------------------------------------------------------------------ |
| Owner  | Add members, remove from organization, assign or revoke seats, change roles, view all member and model usage, manage organization settings |
| Admin  | Same permissions as Owner. Admins are granted by the Owner and can be removed or downgraded.                                               |
| Member | Use assigned API Key and Base URL to call models, view personal usage                                                                      |

## Add members

<Tabs>
  <Tab title="Manual">
    Manually added members cannot log in to the Management Console — they can only use API Keys for model calls.

    1. On the **Members** page, click **Add Member**.
    2. Enter the account name, select the organization role (Admin or Member), and click **Confirm**.
    3. In the member list, click **Assign Seat** for the member, select a seat type, and click **Confirm**.
    4. After the seat is assigned, click **Generate** for the member to create an API Key. The API Key is displayed only once at creation — copy and save it immediately.
    5. Provide the API Key and plan-specific Base URL to the member.
  </Tab>

  <Tab title="SSO login">
    After completing [SAML configuration](#saml-sso), members can log in from the SSO entry on the login page. They are automatically added to the organization and can manage their own seats and API Keys in the Management Console.
  </Tab>
</Tabs>

## Seat operations

### View seat status

On the **Organization Usage** page, you can view the Team Edition subscription status, expiry date, seat count, and remaining Credits. At the top of the **Members** page, you can check the number and type of remaining unassigned seats.

### Assign a seat

1. On the **Members** page, find the target member and click **Assign Seat**.
2. Select a seat type and click **Confirm**.
3. After the seat is assigned, click **Generate** for the member to create an API Key. The API Key is displayed only once at creation — copy and save it immediately.

Provide the API Key and plan-specific Base URL to the member, and they can start calling the corresponding models.

### Revoke a seat

On the **Members** page, find the target member and click **Revoke Seat**. After revocation, the seat returns to unassigned status and can be reassigned to another member.

<Note>
  You must revoke a member's seat before removing them from the organization. Members with active seats cannot be removed.
</Note>

## Member operations

### Change member role

On the Member Management page, find the target member, click **Change Role** in the actions column, select a new role (Admin or Member) in the popup, and save.

### Reset API Key

On the Member Management page, find the target member, click **Reset** in the actions column. After reset, the original API Key is immediately invalidated and the new API Key must be shared with the member again.

### Remove member

On the Member Management page, find the target member, click **Remove from Organization** in the actions column. After removal, the seat is automatically reclaimed and the API Key is immediately invalidated.

## API Keys and Base URL

On the **API Keys** page, you can view and manage the plan-specific Base URL and API Keys.

- **Plan-specific Base URL**: Each plan provides an OpenAI Compatible and an Anthropic Compatible Base URL.
- **API Keys**: After a seat is assigned, you can generate an API Key for model authentication. Each API Key shows its status, seat type, and days remaining, with a **Reset** option available.

## View usage

### Personal Usage

On the **Personal Usage** page, members can view their own Credits consumption.

### Organization Usage

On the **Organization Usage** page, Owners and Admins can view:

- **Subscription info**: Team Edition subscription status, expiry date, seat count, and remaining Credits; Credit Pack information.
- **Usage**: Supports viewing by Usage Trend, Model Usage, and Member Usage, with filters for plan, model, and time range.

## SAML SSO

On the **Settings** page, the **SSO Configuration** section lets you integrate with your enterprise identity provider (IDP) via SAML 2.0 for single sign-on. Once configured, members can log in using their corporate credentials and are automatically added to the organization.

<Steps>
  <Step title="Get IDP information">
    From your enterprise identity provider, obtain the following: **IDP SSO URL**, **IDP Certificate**, and optionally **IDP Entity ID**.
  </Step>

  <Step title="Configure SSO in the Management Console">
    On the **Settings** page, find the **SSO Configuration** section and click **Edit**. Enter a custom **SP Entity ID** and the IDP information obtained above, then click **Confirm**.
  </Step>

  <Step title="Add SP information to your IDP">
    After saving, the system automatically generates an **ACS URL**. Enter the **SP Entity ID** and **ACS URL** into your enterprise IDP's SSO application configuration.
  </Step>

  <Step title="Share the login URL">
    In the **Basic Information** section, copy the **Member Login URL** and share it with your team members. Members can visit this URL and select SSO login to join the organization.
  </Step>
</Steps>

**Parameter reference**

SP information (QwenCloud side):

| Parameter      | Description                                                                                                                                        |
| -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
| SP Entity ID   | QwenCloud's unique identifier in the SSO flow. You define this value and must also enter it in your enterprise IDP.                                |
| ACS URL        | The URL where the IDP sends authentication responses. Automatically generated after saving the SSO configuration. Enter it in your enterprise IDP. |
| SP Certificate | QwenCloud's signing certificate, automatically generated after saving.                                                                             |

IDP information (enterprise side — obtain from your IDP and enter in QwenCloud):

| Parameter       | Description                                                                                          |
| --------------- | ---------------------------------------------------------------------------------------------------- |
| IDP Entity ID   | Your enterprise identity provider's unique identifier (optional).                                    |
| IDP SSO URL     | The login URL of your enterprise IDP. Members are redirected here for authentication.                |
| IDP Certificate | Your enterprise IDP's signing certificate, used by QwenCloud to verify that responses are authentic. |

## Organization settings

On the **Settings** page, you can view and manage basic organization information, including Organization Name (editable), Organization ID, Owner, and Member Login URL.

## FAQ

### Can an API Key still be used after a seat expires?

After a seat expires, the corresponding API Key cannot call models. Renew the subscription and reassign the seat to restore access.

### Can a revoked seat be reassigned to another member?

Yes. After a seat is revoked, it returns to unassigned status and can be immediately reassigned to another member. The original member's API Key will be invalidated at the same time.

### Can a member switch to a different seat?

Each member can hold only one seat at a time. To switch, revoke the current seat first, then assign a new one.