# Accounts & tokens

An account holds your projects, your teammates, and your billing.

Canonical page: https://themachine.myapps.ai/docs/accounts

An account holds your [projects](/docs/project) and the people who work in them. When you sign up, Machine creates a personal account for you. Invite a teammate and it becomes a team account. Personal and team accounts use the same roles, billing, and limits.

## Signing in

One screen signs you in and creates your account the first time. There is no
separate sign-up step. An account can use any of these ways in, all at once:

| Way in | How |
| --- | --- |
| Google | Select the Google button. |
| Email code | Type your email and select **Continue**. Machine emails a sign-in link and a 6-digit code. |
| Password | Select **Use a password instead** and enter your email and password. |
| Single sign-on | Type your work email and select **Continue**, or select **Use single sign-on (SSO)**. Available when your organization has SSO set up. |

A password is optional. To add one, open **Settings → Profile** and find the
**Password** row under **Security**. Select **Set password** and choose one.
Setting a password turns nothing else off: Google and email codes keep working.
To replace a password, select **Change password**; Machine asks for the current
one first.

The same **Security** group holds **Two-factor authentication**, which adds an
authenticator app as a second step after any way in.

## Account roles

Each person in an account has one role:

- **Owner** — full control, including members and billing.
- **Admin** — manages projects and members.
- **Member** — works only in the projects you grant them.

Owner and admin both get manager access to every project in the account. A member sees only the projects they hold a project role on.

Invite a teammate by email from the account's members page. They get access as soon as they accept.

## Project roles

Inside a project, each person holds one role:

- **Member** — runs sessions and triggers.
- **Editor** — also edits the project and manages triggers.
- **Manager** — also manages members and gateway keys, and deletes the project.

Set these from the project's access settings.

## Switching accounts

If you belong to more than one account, switch between them from the account switcher. Each account keeps its own projects, members, and settings.

## Tokens

Scripts, CI jobs, and the CLI use a personal access token instead of your
sign-in. Create one under **Settings → API keys**. Keys you create there start
with `mach_pat_`. The key `machine login` saves for you, and older keys, start
with `kortix_pat_`. Both prefixes work everywhere. A service account
(`kortix_sa_...`) is a separate, non-human credential with no project access
until you grant it.

See [SDK authentication](/docs/sdk/auth) for the full token model.

## Billing

Billing applies at the account level and covers every project in the account. Machine offers a free tier, a pro tier, and a per-seat team tier, each with its own model access and credits. Connected provider keys use the provider's billing relationship and consume zero Machine credits on every plan.

> **Enterprise**
> Single sign-on (SSO), SCIM provisioning, and custom roles are available on the enterprise tier. Contact sales to enable them.