Onboard Your Data Team with API Keys and RBAC in DataXPipe
Invite developers with personal API keys, separate platform admin from developer roles, and stop sharing one production key across the whole data team.
- rbac
- api-keys
- team-onboarding
- multi-tenant
- security
Shared API keys are convenient until someone rotates credentials, a developer registers a half-baked pipeline to production, or an auditor asks who deployed what. DataXPipe gives each teammate a personal key scoped to your organization with a role that controls what the app and API allow.
Roles that match how data teams work
| Role | Typical person | Can do |
|---|---|---|
| Platform admin | Data platform lead | Register pipelines, manage team invites, rotate keys |
| Developer | Analytics engineer | View catalog, validate specs, run checks |
| Admin | Org owner / billing | Full access including billing (when assigned) |
The product UI disables actions your role cannot perform — for example, developers see Validate but not Register on the Upload YAML page.
Permissions align with the API: POST /api/v1/specs/register requires platform role; listing pipelines and validating specs are available more broadly.
Onboarding flow
1. Organization creator (platform admin)
Sign up at app.dataxpipe.com. Copy your API key on the confirmation screen before opening the dashboard — it is only shown once in full.
2. Invite teammates
Settings → Team → enter work email and role → send invite. Teammates receive an email with an accept link.
3. Accept invite
Teammate opens the link, accepts, and lands on the copy your API key screen (same pattern as registration). They sign in with that key going forward.
4. Day-to-day
- Developers iterate on YAML, validate, ask platform admin to register
- Platform admins register specs, manage invites, rotate keys if exposed
API key hygiene
Do not post keys in Slack or commit them to Git. Keys live in browser local storage for the app and in X-API-KEY headers for automation.
Do use recovery when a key is lost: Sign in → Forgot API key → email link → copy new key before continuing.
Do rotate from Settings if a key may have leaked. Platform admins can optionally email the new key to the team when rotating.
Why per-user keys matter
- Auditability — future run metadata can attribute actions to keys (and emails attached to keys)
- Revocation — rotate one person without re-keying the entire team (invite accept creates new keys per user)
- Least privilege — developers cannot bypass UI gates to hit register endpoints
Free tier and team size
The free plan includes 2 pipelines and 2 connections per organization — enough for evaluation. Team invites work on free tier; upgrade when catalog size or retention requires it.
The app shows pipeline usage (for example, “1 of 2 pipelines used”) so admins know when re-registering updates an existing pipeline vs creating a new slot.
Checklist for platform leads
- Create org with a dedicated platform admin account
- Register first pipeline from YAML or dbt import
- Invite developers with developer role
- Document: validate in app → platform admin registers → runs visible to all
- Add CI validation for specs before merge
Related reading
Invite your first teammate from Settings → Team after signing in.