> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fireworks.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> For Fireworks Nexus, start at https://docs.fireworks.ai/nexus.
> Use https://docs.fireworks.ai/nexus/quickstart for coding harnesses, custom agents, APIs, SDKs, and LLM gateways.
> Use https://docs.fireworks.ai/nexus/firerouter for how model routers work, the supported model list, composition, closed-model credentials, and pricing.
> Prefer canonical short model IDs such as firerouter/opus. In LiteLLM litellm_params.model, use the full path fireworks_ai/accounts/fireworks/routers/firerouter/opus.
> Family names such as opus track the latest evaluated family version; do not describe them as fixed model versions.

# Managing users

> Add, delete, and manage roles for users in your Fireworks account

See the concepts [page](/getting-started/concepts#account) for definitions of accounts and users.

## User roles

Each user in an account is assigned a role that determines their level of access:

| Role | Description |
| :- | :- |
| **Admin** | Full administrative control over resources, users, and access. Can manage all account settings and add or remove users. |
| **User** (default) | Can manage all resources, including those owned by others, but cannot manage users or access settings. |
| **Contributor** | Can run inference on any resource and create and manage their own resources. Cannot modify resources owned by others. |
| **Inference User** | Can view all resources and run inference, but cannot create or modify resources. |

#### Resource management

| Permission | Inference User | Contributor | User | Admin |
| :- | :-: | :-: | :-: | :-: |
| Execute inference on any deployment | ✅ | ✅ | ✅ | ✅ |
| View all resources (deployments, models, training jobs, datasets) | ✅ | ✅ | ✅ | ✅ |
| Create new resources (deployments, models, training jobs, datasets) | ❌ | ✅ | ✅ | ✅ |
| Manage their own resources (edit/delete) | ❌ | ✅ | ✅ | ✅ |
| Manage resources owned by others (edit/delete) | ❌ | ❌ | ✅ | ✅ |

#### API key & account management

| Permission | Inference User | Contributor | User | Admin |
| :- | :-: | :-: | :-: | :-: |
| Manage self-owned API keys (create/delete) | ✅ | ✅ | ✅ | ✅ |
| View all users and service accounts | ✅ | ✅ | ✅ | ✅ |
| Create service account API keys | ❌ | ❌ | ❌ | ✅ |
| Delete other users and service accounts API keys | ❌ | ❌ | ❌ | ✅ |
| Add/modify/delete users and their access | ❌ | ❌ | ❌ | ✅ |

## Adding users

To add a new user to your Fireworks account, run the following command. If the email for the new user is already associated with a Fireworks account, they will have the option to freely switch between your account and their existing account(s). You can also add users in the Fireworks web UI at [https://app.fireworks.ai/account/users](https://app.fireworks.ai/account/users).

```bash theme={null}
firectl user create --email="alice@example.com"
```

To create another admin user, pass the `--role=admin` flag:

```bash theme={null}
firectl user create --email="alice@example.com" --role=admin
```

## Updating a user's role

To update a user's role, run

```bash theme={null}
firectl user update <USER_ID> --role=<ROLE>
```

Where `<ROLE>` is one of: `admin`, `user`, `contributor`, or `inference-user`.

## Deleting users

You can remove a user from your account by running:

```bash theme={null}
firectl user delete <USER_ID>
```

## Groups

Users can be organized into groups. A group is a named set of users in your account; the **Groups** tab on the [Users page](https://app.fireworks.ai/account/users) lists each group with its member count and source, and the **Group** column on the Users tab shows which groups a user belongs to.

Groups are provisioned from your identity provider through [SCIM group provisioning](/accounts/sso#group-provisioning), which is the only way to create one. They are read-only in Fireworks: create, rename, delete, and populate groups in your directory.

Groups do not confer roles — roles are set per user. What a group can carry is a [group limit](/nexus/usage-limits#group-limits), which caps serverless spend for each of its members. That is a **Fireworks Nexus** feature, enabled separately from group sync.