Understanding the Client Role

The Client role provides scoped, read-only access to your team's infrastructure. Unlike other roles that can see all providers on a team, clients only see the specific providers you assign to them. This makes it ideal for giving external stakeholders visibility without exposing your entire DNS setup.

Clients have read-only access to the providers you explicitly assign to them. For each assigned provider, they can view:

• Providers: View provider details for their assigned providers
• Zones: View all zones belonging to their assigned providers
• DNS Records: View DNS records within their assigned providers' zones
• Checks: View monitoring checks and their results for assigned providers
• Certificates: View SSL certificate details for assigned providers

The Client role is strictly read-only and provider-scoped. Clients cannot:

• Create, edit, or delete any providers, zones, or DNS records
• Configure notifications or notification channels
• Access billing or team settings
• Create or use API tokens — all API access is blocked for clients
• Use the DNS Lookup tool
• View reports
• See providers they have not been explicitly assigned

When you invite a team member with the Client role, you can select which providers they should have access to. You can update their provider assignments at any time from the team settings. Each client can be assigned to one or more providers on your team.

Team members with the Client role count against your team's member limit just like any other role. When considering how many client seats you need, keep this in mind when choosing your plan.