# Organizations

Daytona provides organizations as a way to group resources and enable collaboration. Users can work individually in their personal organization or together in a collaborative organization.

Manage your organizations in the [Daytona Dashboard ↗](https://app.daytona.com/dashboard) or through the [API](https://www.daytona.io/docs/en/v2/api.md).

## Personal vs Collaborative

Every Daytona user starts with a personal organization for solo use and experimentation. Collaborative organizations are created manually for teams, with shared access and controls.

| **Feature**        | **Personal organization**        | **Collaborative organization**                 |
| ------------------ | -------------------------------- | ---------------------------------------------- |
| **Creation**       | Automatic on signup              | Manually by a user                             |
| **Members**        | Single user only                 | Multiple users (invite-based)                  |
| **Access Control** | No roles or permissions          | Roles with fixed permission sets               |
| **Billing**        | Tied to individual user          | Shared across team members                     |
| **Use Case**       | Personal testing, small projects | Company/team development and production        |
| **Quota Scope**    | Per user                         | Shared across all members                      |
| **Deletable**      | No                               | Yes (by admins)                                |

Switch between personal and collaborative organizations with the dropdown in the [Daytona Dashboard ↗](https://app.daytona.com/dashboard) sidebar. Each organization has its own sandboxes, API keys, and resource quotas.

## Create organization

Create organizations in the [Daytona Dashboard ↗](https://app.daytona.com/dashboard/) or with the [API](https://www.daytona.io/docs/en/v2/api.md).

1. Go to [Daytona Dashboard ↗](https://app.daytona.com/dashboard/)
2. Expand the dropdown at the top-left corner of the sidebar to view your organizations
3. Click <Button>Create Organization</Button>
4. Enter the organization name
5. Select a [region](https://www.daytona.io/docs/en/v2/regions.md)
6. Click <Button>Create</Button>


```bash
daytona org create 'My Organization'
```


```bash
curl 'https://api.daytona.com/orgs' \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --data '{
  "name": "My Organization"
}'
```

| **Field** | **Type** | **Description**                                                                                                             |
| --------- | -------- | --------------------------------------------------------------------------------------------------------------------------- |
| **`name`**    | **`string`** | Required. Trimmed, and must be 1 to 100 characters with no control characters; otherwise the request returns **`400 Bad Request`**. |

- The caller becomes the first admin of the organization.
- The response is the caller's membership in the new organization, including the caller's roles and permissions.


## Operations

### List organizations

List all organizations the authenticated user belongs to.


```bash
daytona org list
```


```bash
curl 'https://api.daytona.com/orgs' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```


### Select organization

Select the organization that following CLI commands run against. The CLI also restores the [project](https://www.daytona.io/docs/en/v2/projects.md#select-project) you last used in that organization, or its default project. Pass an ID or an unambiguous name; with no argument, the CLI shows a picker at a terminal.


```bash
daytona org use ORGANIZATION_ID
```


### Get by ID

Get an organization by ID.


```bash
daytona org get ORGANIZATION_ID
```


```bash
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```


### Current user


```bash
# The signed-in user, the credential in use, and the selected organization and project
daytona whoami
```


```bash
# The calling user: id, email, name
curl 'https://api.daytona.com/me' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```


### Current organization API key

Get the organization API key that authenticates the request, with the organization permissions it holds now. The route accepts organization API keys only; a signed-in user token returns `403`. The response never contains the token.


```bash
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/api-keys/current' \
  --header 'Authorization: Bearer YOUR_ORG_API_KEY'
```

```json
{
  "id": "KEY_ID",
  "org_id": "ORGANIZATION_ID",
  "name": "my-org-key",
  "key_prefix": "dtno_...",
  "org_permissions": ["read:audit"],
  "created_at": "2026-09-10T12:00:00Z",
  "expires_at": null,
  "last_used_at": "2026-09-11T08:30:00Z",
  "revoked_at": null
}
```


### Rename organization

Rename an organization. The new name follows the same rules as on create: it is trimmed, and must be 1 to 100 characters with no control characters.


```bash
daytona org update ORGANIZATION_ID --name 'New Organization Name'
```


```bash
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID' \
  --request PATCH \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --data '{
  "name": "New Organization Name"
}'
```


### Leave organization

Leave an organization.

1. Go to [Daytona Dashboard ↗](https://app.daytona.com/dashboard/)
2. Expand the dropdown at the top-left corner of the sidebar to view your organizations
3. Select the organization you want to leave
4. Click <Button>Settings</Button> in the sidebar
5. Click <Button>Leave Organization</Button>
6. Confirm by clicking <Button>Leave</Button>


```bash
daytona org leave ORGANIZATION_ID
```

- **`daytona org leave`** asks for confirmation.
- **`daytona org leave`** revokes the API keys you minted in the organization.
- **`daytona org leave`** forgets the project keys and platform tokens that the CLI cached for the organization.


```bash
# Leaving is a self-removal: USER_ID is the id returned by GET /me
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/members/USER_ID' \
  --request DELETE \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```

- Leaving revokes every project and organization API key you minted in the organization.
- Leaving deletes the signed preview grants you minted.


### Delete organization

Delete an organization.

1. Go to [Daytona Dashboard ↗](https://app.daytona.com/dashboard/)
2. Expand the dropdown at the top-left corner of the sidebar to view your organizations
3. Select the organization you want to delete
4. Click <Button>Settings</Button> in the sidebar
5. Click <Button>Delete Organization</Button>
6. Confirm the deletion by typing the organization name and clicking <Button>Delete</Button>


```bash
daytona org delete ORGANIZATION_ID
```

- **`daytona org delete`** asks for confirmation before deleting.
- You cannot delete a personal organization.


```bash
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID' \
  --request DELETE \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```

- A successful delete revokes every API key in every project.
- A successful delete removes the organization's members, invitations, service accounts, and projects.


## Limits

Get the effective [organization limits](https://www.daytona.io/docs/en/v2/limits.md#organization-limits) and the current usage they are checked against. Each limit reports its effective cap and the usage counted against it. The member limit also counts the pending invitations that reserve a seat.


```bash
# The argument is optional; omit it to use the selected organization
daytona org limits ORGANIZATION_ID
```

- **`daytona org limits`** requires the **`read:organization`** permission.


```bash
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/limits' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```

```json
{
  "sandboxes": {
    "concurrent": { "limit": 10, "usage": 2 },
    "total": { "limit": 50, "usage": 4 },
    "gpu_concurrent": { "limit": 0, "usage": 0 },
    "windows_concurrent": { "limit": 0, "usage": 0 }
  },
  "image_builds": { "concurrent": { "limit": null, "usage": 0 } },
  "members": { "limit": 5, "usage": 3, "pending_invitations": 1 },
  "api_keys_per_organization": { "limit": 1000, "usage": 12 },
  "api_keys_per_project": { "limit": 100, "usage": 7 },
  "secrets_per_project": { "limit": 500, "usage": 20 }
}
```

The response has the following fields:

| **Field**                   | **Description**                                                                                                     |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------- |
| **`limit`**                     | Each limit reports its effective cap in **`limit`**. A value of **`null`** means no limit. Reaching the cap refuses new work. |
| **`usage`**                     | Each limit reports the current usage counted against it in **`usage`**.                                                 |
| **`sandboxes`**                 | The concurrent and total sandbox limits.                                                                            |
| **`image_builds`**              | The concurrent image build limit.                                                                                   |
| **`members`**                   | The seat cap. **`pending_invitations`** counts the invitations that reserve a seat until they are accepted or declined. |
| **`api_keys_per_organization`** | The live API key limit of the organization.                                                                         |
| **`api_keys_per_project`**      | The live API key limit of any one project, with the highest current usage.                                          |
| **`secrets_per_project`**       | The secret limit of any one project, with the highest current usage.                                                |

- **`GET /orgs/ORGANIZATION_ID/limits`** requires the **`read:organization`** permission.


### Set the timeout cap

Set or clear the organization's maximum sandbox timeout. Daytona validates every sandbox [timeout](https://www.daytona.io/docs/en/v2/linux-sandboxes.md#timeout) against this cap. The cap can be any value up to the platform maximum, which is 86400 seconds by default; clearing it inherits the platform maximum. The organization reports the cap as `max_sandbox_timeout_seconds`.


```bash
# Cap every sandbox timeout in the organization at 1 hour
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID' \
  --request PATCH \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --data '{ "max_sandbox_timeout_seconds": 3600 }'

# Clear the cap and inherit the platform maximum
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID' \
  --request PATCH \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --data '{ "max_sandbox_timeout_seconds": null }'
```

| **Field**                     | **Type**  | **Description**                                                                                     |
| ----------------------------- | --------- | --------------------------------------------------------------------------------------------------- |
| **`max_sandbox_timeout_seconds`** | **`integer`** | Sets the cap in seconds, up to the platform maximum. A value of **`null`** clears the cap. A value above the platform maximum returns **`400`**. |

- The response is the updated organization.
- Setting the cap accepts only a signed-in user token and requires the **`write:organization`** permission.


## Entitlements and feature flags

Entitlements are the capabilities an organization's plan grants; feature flags are platform switches evaluated per organization. Both are read-only and return every catalog key, so a client never has to guess at an absent key. Requires `read:organization`, which every role includes.

### Entitlements


```bash
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/entitlements' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```

```json
{
  "entitlements": {
    "preview_warning_opt_out": false
  }
}
```


### Feature flags


```bash
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/feature-flags' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```


## Preview warning

Turn the preview warning page off or on. It applies to every [sandbox preview](https://www.daytona.io/docs/en/v2/preview.md) in the organization and decides whether a visitor sees the warning page first.

:::note[Plan required]
Turning the preview warning off is available on request.
:::


```bash
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/preview-warning' \
  --request PATCH \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{ "disabled": true }'
```

| **Field** | **Type** | **Description** |
| --------- | -------- | --------------- |
| **`disabled`** | **`boolean`** | Turns the preview warning off when **`true`** and on when **`false`**. |

- **`PATCH /orgs/ORGANIZATION_ID/preview-warning`** requires the **`write:organization`** permission.
- The preview warning has no **`GET`** route.
- The current value is the **`preview_warning_disabled`** field of the organization that the list and get routes return.


## Telemetry forwarding

### Get the configuration

Get the telemetry forwarding configuration. Daytona forwards the organization's sandbox logs, traces, and metrics to the OTLP/HTTP endpoint in this configuration. The response lists the names of the configured request headers; header values are write-only and never returned.


```bash
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/otel-config' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```

```json
{
  "endpoint": "https://otel.example.com",
  "header_names": ["Authorization"],
  "created_at": "2026-09-10T12:00:00Z",
  "updated_at": "2026-09-10T12:00:00Z"
}
```


### Set the configuration

Set telemetry forwarding. Each write replaces the whole configuration, including headers.


```bash
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/otel-config' \
  --request PUT \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{
  "endpoint": "https://otel.example.com",
  "headers": { "Authorization": "Bearer YOUR_COLLECTOR_TOKEN" }
}'
```

| **Field**  | **Type** | **Description**                                                                                                                                                                                                                  |
| ---------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **`endpoint`** | **`string`** | Required. Must use **`https`**, be at most 2048 bytes, and resolve only to public IP addresses; **`localhost`** and local host names are refused. The collector appends **`/v1/logs`**, **`/v1/traces`**, or **`/v1/metrics`** to the endpoint for each signal. |
| **`headers`**  | **`object`** | Holds at most 16 entries and at most 16 KiB of names and values in total. Header names are 1 to 128 bytes and unique regardless of case. Header values are 1 to 4096 bytes of visible ASCII, space, or tab. You cannot set transport headers such as **`Host`**, **`Content-Type`**, and **`Content-Length`**. You also cannot set **`User-Agent`** or any **`Proxy-*`** header. To keep a stored header value without resending the value, pass **`********`** as the value. |


### Delete the configuration

Delete the telemetry forwarding configuration. Sandbox telemetry stops being forwarded.


```bash
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/otel-config' \
  --request DELETE \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```

- The request returns **`204 No Content`**, also when no configuration is set.


## macOS settings

The macOS settings control [auto-reserve](https://www.daytona.io/docs/en/v2/macos-sandboxes.md#auto-reserve) for [macOS sandboxes](https://www.daytona.io/docs/en/v2/macos-sandboxes.md). With auto-reserve on, a macOS create in a region where the organization holds no live Mac reservation buys a 24-hour reservation that renews while a sandbox runs on it. Auto-reserve is on by default, and the organization caps how many auto-reserved reservations it holds at once.

### Get the settings

Get the organization's macOS settings.


```bash
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/macos-settings' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```

```json
{
  "macos_auto_reserve": true,
  "macos_auto_reserve_max_reservations": 2,
  "macos_auto_reserve_disabled_at": null,
  "macos_auto_reserve_disabled_by": null
}
```

The response has the following fields:

| **Field**                              | **Description**                                                                                     |
| -------------------------------------- | --------------------------------------------------------------------------------------------------- |
| **`macos_auto_reserve`**                   | Shows whether auto-reserve is on.                                                                   |
| **`macos_auto_reserve_max_reservations`**  | The most auto-reserved reservations the organization holds at once.                                 |
| **`macos_auto_reserve_disabled_at`**       | Records when auto-reserve was last turned off. The value is **`null`** while auto-reserve is on.        |
| **`macos_auto_reserve_disabled_by`**       | Records who last turned auto-reserve off. The value is **`null`** while auto-reserve is on.             |

- **`GET /orgs/ORGANIZATION_ID/macos-settings`** requires the **`read:organization`** permission.


### Set the settings

Turn auto-reserve on or off, or change the cap on auto-reserved reservations. Fields left out of the request keep their stored values.


```bash
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/macos-settings' \
  --request PATCH \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{ "macos_auto_reserve": true, "macos_auto_reserve_max_reservations": 4 }'
```

| **Field**                              | **Type** | **Description**                                                                       |
| -------------------------------------- | -------- | ------------------------------------------------------------------------------------- |
| **`macos_auto_reserve`**                   | boolean  | Turns auto-reserve on or off. If omitted, the stored value stays unchanged. Turning auto-reserve off while it is already off keeps the original **`macos_auto_reserve_disabled_at`** and **`macos_auto_reserve_disabled_by`**. Turning auto-reserve on clears both fields. |
| **`macos_auto_reserve_max_reservations`**  | integer  | Sets the most auto-reserved reservations the organization holds at once. If omitted, the stored value stays unchanged. The value must be at least **`1`**. A cap below **`1`** returns **`400`**. |

- **`PATCH /orgs/ORGANIZATION_ID/macos-settings`** requires the **`write:organization`** permission.
- Set at least one field in the request.


## Roles

Each member of an organization holds one or more roles. A role is a fixed set of permissions, and a member's permissions are the union of the permissions of all roles they hold. The admin role is protected: the organization must always keep at least one admin, and only an admin can grant or remove it. An invitation that names no roles grants the developer role.

| **Role**                       | **Description**                                                                                      |
| ------------------------------ | ---------------------------------------------------------------------------------------------------- |
| **`admin`**                    | Full control of the organization, its members, and everything in it                                  |
| **`maintainer`**               | Full control of everything inside the organization's projects, with no authority over the organization itself |
| **`developer`**                | Run and manage sandboxes, invoke functions, and view everything a sandbox can use                    |
| **`read-only`**                | View every project resource, and change none of them                                                 |
| **`member`**                   | Sign in and see the organization, with no access to any resource                                     |
| **`auditor`**                  | Read the organization's [audit log](https://www.daytona.io/docs/en/v2/audit-logs.md), without the ability to turn it off         |
| **`billing`**                  | See what the organization spends and manage how it pays                                              |
| **`spending-viewer`**          | See what the organization spends, and nothing about how it pays                                      |
| **`sso-admin`**                | Configure [single sign-on](https://www.daytona.io/docs/en/v2/sso.md) for the organization                                        |
| **`infrastructure-admin`**     | Manage the organization's own regions and runners                                                    |
| **`sandboxes-manager`**        | Create, change, and delete sandboxes                                                                 |
| **`snapshots-manager`**        | Create, change, and delete snapshots and images                                                      |
| **`registries-manager`**       | Create, change, and delete private container registries                                              |
| **`secrets-manager`**          | Create, change, and delete project secrets                                                           |
| **`functions-manager`**        | Deploy, invoke, change, and delete serverless functions                                              |

### List roles

List all roles in an organization.


```bash
# The fixed role catalog and the permission each role grants
daytona role list
```


```bash
# The fixed role catalog and the permission each role grants
curl 'https://api.daytona.com/roles' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```


## Members

Daytona provides methods to manage members in an organization.

### List members

List all members in an organization.


```bash
daytona member list --org ORGANIZATION_ID
```


```bash
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/members' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```


### Invite members

Invite a new user to an organization.

1. Go to [Daytona Dashboard ↗](https://app.daytona.com/dashboard/members)
2. Click <Button>Invite Member</Button>
3. Enter the email address of the user you want to invite
4. Select one or more [roles](#roles) for the new user under **Roles**


```bash
daytona invite create mail@example.com --org ORGANIZATION_ID --role developer
```

| **Flag** | **Type** | **Description**                       |
| -------- | -------- | ------------------------------------- |
| **`--role`** | **`string`** | A comma-separated list of role slugs. |

- When the deployment sends no email, **`daytona invite create`** prints the invitation link instead.


```bash
# roles defaults to ["developer"] when omitted
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/invitations' \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --data '{
  "email": "mail@example.com",
  "roles": ["developer"]
}'
```

- An invitation expires 14 days after you send the invitation.
- Inviting the same address again issues a new token.
- Inviting the same address again resends the invitation.
- Seated members and open invitations count toward the seat cap.
- The response carries **`accept_url`** only when the deployment sends no email.


### Remove members

Remove a user from an organization.

1. Go to [Daytona Dashboard ↗](https://app.daytona.com/dashboard/members)
2. Click <Button>Remove</Button> next to the user you want to remove
3. Confirm the removal by clicking <Button>Remove</Button>


```bash
# Preview what the member loses before removing them
daytona member remove USER_ID --org ORGANIZATION_ID --preview

daytona member remove USER_ID --org ORGANIZATION_ID
```


```bash
# Preview what the member loses before removing them
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/members/USER_ID/removal-preview' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'

curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/members/USER_ID' \
  --request DELETE \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```

The response has the following fields:

| **Field**                | **Description**                                                                                                              |
| ------------------------ | ---------------------------------------------------------------------------------------------------------------------------- |
| **`revoked_keys`**           | Holds the count of project and organization API keys that the removal revokes.                                               |
| **`revoked_preview_grants`** | Holds the count of signed preview grants that the removal deletes. In the preview response, the value is **`null`** when the count is unknown, not **`0`**. |

- Removing another member requires the **`delete:members`** permission.


### Update access

Update the access of a member in an organization.

1. Go to [Daytona Dashboard ↗](https://app.daytona.com/dashboard/members)
2. Click the three-dot menu on the member row
3. Click <Button>Edit roles</Button>
4. Select the member's [roles](#roles) and click <Button>Save</Button>


```bash
# Replace the member's role set
daytona member update USER_ID --org ORGANIZATION_ID --role maintainer,billing

# Rehearse the change without applying it
daytona member update USER_ID --org ORGANIZATION_ID --role read-only --dry-run
```


```bash
# Replace the member's role set
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/members/USER_ID' \
  --request PATCH \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --data '{
  "roles": ["maintainer", "billing"]
}'

# Rehearse the change without applying it: { "revoked_api_keys": ..., "revoked_preview_grants": ... }
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/members/USER_ID/update-preview' \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --data '{
  "roles": ["read-only"]
}'
```

| **Field** | **Type**   | **Description**                                      |
| --------- | ---------- | ---------------------------------------------------- |
| **`roles`**   | **`string[]`** | Required. Replaces the member's whole role set.      |

- You cannot change your own roles.
- You can change only a member whose current and new permissions you hold.
- Only an admin can grant or remove the **`admin`** role.


## Invitations

View an organization invitation from the link or token in the invitation email.

1. Open the link in the invitation email; it opens [Daytona Dashboard ↗](https://app.daytona.com/dashboard/user/invitations)
2. Review the organization, inviter, roles, and expiry of the invitation


```bash
# Show the invitation behind the dtni_ token or the link from the invitation email
daytona invite show INVITATION_TOKEN
```


```bash
# Show the invitation behind the dtni_ token from the invitation email
curl 'https://api.daytona.com/invitations/lookup' \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --data '{ "token": "INVITATION_TOKEN" }'
```


### Accept invitation

Accept a pending organization invitation.

1. Open the link in the invitation email; it opens [Daytona Dashboard ↗](https://app.daytona.com/dashboard/user/invitations)
2. Sign in if prompted
3. Review the organization, inviter, roles, and expiry of the invitation
4. Click <Button>Accept</Button>


```bash
daytona invite accept INVITATION_TOKEN
```


```bash
curl 'https://api.daytona.com/invitations/accept' \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --data '{ "token": "INVITATION_TOKEN" }'
```

- The token is single-use.
- If you are already a member, you keep your roles.
- If you are already a member, accepting still consumes the invitation.


Once a user accepts an invitation to join an organization, they get access to the organization's resource quotas and can create an [API key](https://www.daytona.io/docs/en/v2/api-keys.md) and sandboxes.

### Decline invitation

Decline a pending organization invitation.

1. Open the link in the invitation email; it opens [Daytona Dashboard ↗](https://app.daytona.com/dashboard/user/invitations)
2. Sign in if prompted
3. Review the organization, inviter, roles, and expiry of the invitation
4. Click <Button>Decline</Button>
5. Confirm by clicking <Button>Decline</Button>


```bash
daytona invite decline INVITATION_TOKEN
```


```bash
curl 'https://api.daytona.com/invitations/decline' \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --data '{ "token": "INVITATION_TOKEN" }'
```

- The organization sees the invitation as declined until the invitation is revoked or the address is invited again.


### List pending

List pending invitations for an organization.


```bash
daytona invite list --org ORGANIZATION_ID
```


```bash
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/invitations' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```

- The list contains every invitation that has not been accepted, including pending, declined, and expired invitations.
- Use **`declined_at`** and **`expires_at`** to tell pending, declined, and expired invitations apart.


### Cancel invitation

Cancel an invitation for an organization.

1. Go to [Daytona Dashboard ↗](https://app.daytona.com/dashboard/members)
2. Scroll to the **Invitations** table
3. Click the three-dot menu on the invitation row
4. Click <Button>Cancel</Button>
5. Confirm by clicking <Button>Confirm</Button>


```bash
daytona invite revoke INVITATION_ID --org ORGANIZATION_ID
```


```bash
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/invitations/INVITATION_ID' \
  --request DELETE \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```