Managing users

Add, delete, and manage roles for users in your Fireworks account

See the concepts page for definitions of accounts and users.

User roles

Each user in an account is assigned a role that determines their level of access:

Role	Description
Admin	Full administrative control over resources, users, and access. Can manage all account settings and add or remove users.
User (default)	Can manage all resources, including those owned by others, but cannot manage users or access settings.
Contributor	Can run inference on any resource and create and manage their own resources. Cannot modify resources owned by others.
Inference User	Can view all resources and run inference, but cannot create or modify resources.

The contributor and inference-user roles are newer roles that provide more granular access control. Contact Fireworks support if you need these roles enabled for your account.

Resource management

Permission	Inference User	Contributor	User	Admin
Execute inference on any deployment	✅	✅	✅	✅
View all resources (deployments, models, training jobs, datasets)	✅	✅	✅	✅
Create new resources (deployments, models, training jobs, datasets)	❌	✅	✅	✅
Manage their own resources (edit/delete)	❌	✅	✅	✅
Manage resources owned by others (edit/delete)	❌	❌	✅	✅

API key & account management

Permission	Inference User	Contributor	User	Admin
Manage self-owned API keys (create/delete)	✅	✅	✅	✅
View all users and service accounts	✅	✅	✅	✅
Create service account API keys	❌	❌	❌	✅
Delete other users and service accounts API keys	❌	❌	❌	✅
Add/modify/delete users and their access	❌	❌	❌	✅

Adding users

To add a new user to your Fireworks account, run the following command. If the email for the new user is already associated with a Fireworks account, they will have the option to freely switch between your account and their existing account(s). You can also add users in the Fireworks web UI at https://app.fireworks.ai/account/users.

firectl user create --email="[e-mail]"

To create another admin user, pass the --role=admin flag:

firectl user create --email="[e-mail]" --role=admin

Updating a user’s role

To update a user’s role, run

firectl user update <USER_ID> --role=<ROLE>

Where <ROLE> is one of: admin, user, contributor, or inference-user.

Deleting users

You can remove a user from your account by running:

firectl user delete <USER_ID>

Groups

Users can be organized into groups. A group is a named set of users in your account; the Groups tab on the Users page lists each group with its member count and source, and the Group column on the Users tab shows which groups a user belongs to.

Groups are provisioned from your identity provider through SCIM group provisioning, which is the only way to create one. They are read-only in Fireworks: create, rename, delete, and populate groups in your directory.

Groups do not confer roles — roles are set per user. What a group can carry is a group limit, which caps serverless spend for each of its members. That is a Fireworks Nexus feature, enabled separately from group sync.