> ## Documentation Index > Fetch the complete documentation index at: https://docs.tinyfish.ai/llms.txt > Use this file to discover all available pages before exploring further. # Organizations > Use TinyFish as a team: shared billing, personal and workflow keys, and single sign-on > [!WARNING] > > **Beta:** Organizations are in beta and available only through sales. [Contact sales](https://rx5dp.share-na2.hsforms.com/2xm5sf8OTQjWqjTTSl9V1tQ) to set one up for your team. An organization is a team account. Its members work under one contract, and everything they do for the organization is recorded on it and billed to it. ## Acting for an organization or for yourself Every request acts for one place: an organization you belong to, or **Personal**, your own account. * **Dashboard:** the organization switcher sets where you act. Keys, usage and settings follow that choice. * **API keys:** a key acts for the organization it was created in. A key created under Personal acts for Personal. * **Connected AI tools (MCP):** when you connect a tool and belong to more than one place, the consent page asks which one it should act for. The choice is saved for that tool. Your own wallet and free allowances pay for Personal usage. ## Roles Each person in an organization is an **admin** or a **member**. The person TinyFish sets the organization up for is its owner and an admin. * Admins invite and remove people, change roles, create workflow keys and set spend limits. * Changes made in TinyFish always leave the organization at least one admin, and admins can't remove or demote the owner. ## Personal keys and workflow keys An organization has two kinds of API key. | | Personal key | Workflow key | | - | - | - | | Belongs to | The person who created it | The organization | | Who can create one | Admins, and members when **Members can create API keys** is on (Settings, General) | Admins only | | What admins can do with it | Revoke it. Admins can never see its value | Everything its creator can, including reveal | | When its creator leaves | Stops working | Keeps working | Removing someone from an organization revokes their personal keys for it at once. Their workflow keys stay, because they belong to the organization. While removing someone, an admin can choose to revoke workflow keys that person created. Use workflow keys for shared automations and backend services that must keep running when people change. Use personal keys for your own work. ## What an organization can use While you act for an organization, you can use **Agent**, **Browser**, **Search** and **Fetch**. Other products aren't available for organizations yet. Switch to Personal to use them. Vault credentials and [Browser Context Profiles](/key-concepts/browser-context-profiles.md) stay personal. A workflow key can't use them at all: a request with `use_vault` or `use_profile`, or a call to a vault or profile endpoint, is refused with [`FORBIDDEN`](/error-codes#forbidden) and `details.reason` `workflow_key_personal_credentials`. Use a personal key instead. ## Who pays The organization's contract pays for everything done for the organization, by any member or key. Prices and invoicing come from that contract. A member's wallet and free allowances are never used for organization work. If the organization can't pay, the request is refused. It never falls back to your wallet. ## Spend limits and alerts Admins can set a monthly spend limit for the organization in Settings, General, under **Monthly spend cap**. The limit resets on the 1st of each month (UTC). Admins get an email when spending reaches 50%, 80% and 100% of the limit, once per level each month. The email is an alert only: reaching the limit doesn't pause anything, and usage keeps running. Limits for individual members and keys can be recorded, but they don't stop usage and don't send alerts yet. ## Single sign-on and directory sync Your team can sign in through your identity provider with SAML single sign-on, for example Okta. TinyFish sets this up with your IT team during onboarding. With directory sync, people your identity provider assigns to TinyFish join the organization as members automatically, without an invitation, up to the organization's seat limit. When your identity provider deactivates someone, TinyFish removes them from the organization and revokes their personal keys, so their access ends. If that person is the owner, ownership is cleared, not transferred. If they are the last admin, the organization is left without an admin. Workflow keys keep working. > [!NOTE] > > Remove people in your identity provider, not only in TinyFish. Someone who is still active there joins the organization again the next time they sign in. ## Errors you may see These are the refusals specific to organizations. All use the standard [error format](/error-codes.md#error-response-format). | Situation | HTTP | `code` | `details.reason` | What to do | | - | - | - | - | - | | The organization can't pay for the request, or you're no longer a member (while your key still works) | 403 | `FORBIDDEN` | `organization_not_billable` | Don't retry. Ask an admin of the organization to contact TinyFish | | TinyFish couldn't check the organization's billing | 503 | `SERVICE_BUSY` | `billing_unavailable` | Retry with backoff | | A workflow key asked for vault credentials or a Browser Context Profile | 403 | `FORBIDDEN` | `workflow_key_personal_credentials` | Use a personal key | | The product isn't available for organizations yet | 403 | `FORBIDDEN` | none | Use the product from Personal | A personal key revoked when someone is removed from the organization returns 401 `INVALID_API_KEY`, not this refusal. On Search and Fetch, the first two refusals return the same status, code and message, without `details.reason`. The message for `organization_not_billable` reads: "This organization can't pay for this request, or you're no longer a member, so it was not started. Ask an admin of the organization to contact TinyFish to set up billing." Connected AI tools (MCP) get the same reasons as tool errors. They can also see these: * `organization_choice_required`: the tool has no organization chosen, or you left the one it used. Follow the link in the message, or reconnect the tool, and choose an organization. * `organization_membership_removed`: you were removed from the organization this connection acts for. Ask an admin to invite you again. * `organization_unresolved`: TinyFish couldn't check which organization this connection acts for. Retry in a moment. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.