Create SSH-key-management.mdx

accounts-billing/manage-accounts.mdx

@@ -29,19 +29,11 @@ You can revert your account back to a personal account at any time. To revert, s
 
 ## Invite team members
 
-Team accounts can invite new members to collaborate. Each invitation includes a specific role that determines the member's permissions.
+Team accounts can invite new members to collaborate, and each invitation includes a specific role that determines the member's permissions.
 
 <img src="https://promptless-customer-doc-assets.s3.amazonaws.com/docs-images/org_2tHD09rTU0IcE4clVjTuJCTn0an/create-team-invite-dialog-d8cb3fc6.png" alt="Create Team Invite dialog showing role selection and required email field" />
 
-To invite a new member:
-
-1. Navigate to the [Team page](https://www.console.runpod.io/team) in the Runpod console.
-2. In the **Members** section, select **Invite New Member**.
-3. Choose [the appropriate role](#roles-and-permissions) for the new member.
-4. Enter the email address of the person you want to invite and click **Create Invite**.
-5. Copy the generated invitation link from the **Pending Invites** section and share it with the person you want to invite.
-
-Invitation links remain active until used or manually revoked. You can view all pending invitations in the team management interface.
+For step-by-step instructions on inviting a member and choosing their role, see [Assign a role to a team member](/accounts-billing/roles-and-permissions#assign-a-role-to-a-team-member).
 
 ## Join a team
 
@@ -50,52 +42,17 @@ When invited to join a team, you'll receive an invitation link from a team membe
 1. Click the invitation link provided by the team member.
 2. Select **Join Team** to accept the invitation.
 
-Your account will gain access to the team's resources based on the role assigned to you.
+Your account will gain access to the team's resources based on the role assigned to you. To see what your assigned role allows, see [Roles and permissions](/accounts-billing/roles-and-permissions).
 
 ## Roles and permissions
 
-Runpod provides four distinct roles to control access within team accounts. Each role includes specific permissions designed for different responsibilities.
-
-| Permission | Basic | Billing | Dev | Admin |
-|------------|-------|---------|-----|-------|
-| Access team account | ✅ | ✅ | ✅ | ✅ |
-| Connect to existing Pods | ✅ | ❌ | ✅ | ✅ |
-| Create/delete/start/stop Pods | ❌ | ❌ | ✅ | ✅ |
-| Create/delete Serverless endpoints | ❌ | ❌ | ✅ | ✅ |
-| Send requests to Serverless endpoints | ✅ | ❌ | ✅ | ✅ |
-| Connect to existing Instant Clusters | ✅ | ❌ | ✅ | ✅ |
-| Create/delete/start/stop Instant Clusters | ❌ | ❌ | ❌ | ✅ |
-| Create/update/delete network volumes | ❌ | ❌ | ✅ | ✅ |
-| View billing information | ❌ | ✅ | ❌ | ✅ |
-| Manage payment methods | ❌ | ✅ | ❌ | ✅ |
-| Invite team members | ❌ | ❌ | ❌ | ✅ |
-| Manage team permissions | ❌ | ❌ | ❌ | ✅ |
-| Modify team account settings | ❌ | ❌ | ❌ | ✅ |
-| Access audit logs | ❌ | ❌ | ❌ | ✅ |
-
-### Basic role
-
-The basic role provides essential access for users who need to work with existing resources without management capabilities.
-
-This role allows users to access the team account and connect to already-deployed computing resources (e.g., Pods and Serverless endpoints) for development work. Users with this role cannot view billing information, start or stop Pods, or create new resources.
-
-### Billing role
+Runpod team accounts provide four built-in roles (Basic, Billing, Dev, and Admin) that control access to Pods, Serverless endpoints, network volumes, and billing. Each role grants a different set of permissions.
 
-The billing role focuses exclusively on financial management aspects of the account.
+For the full permissions matrix and guidance on assigning and revoking roles, see [Roles and permissions](/accounts-billing/roles-and-permissions).
 
-Users with this role can access all billing information, manage payment methods, and view invoices. They cannot access computing resources, making this role ideal for finance team members who need billing access without operational permissions.
-
-### Dev role
-
-The dev role extends basic permissions with additional capabilities for active development work.
-
-This role includes all basic permissions plus the ability to start, stop, and create Pods. Developers can fully manage computing resources for their work while remaining restricted from billing information and account settings.
-
-### Admin role
-
-The admin role provides complete control over all account features and settings.
-
-Administrators have unrestricted access to manage team members, configure account settings, handle billing, and control all team computing resources. This role should be reserved for team leaders and trusted members who need full account access.
+<Tip>
+Apply the principle of least privilege by assigning each member the minimum role necessary for their work.
+</Tip>
 
 ## Account spend limits
 
@@ -113,9 +70,7 @@ Regular review of audit logs helps identify unusual activity and ensures team me
 
 ## Best practices
 
-When managing team accounts, establish clear role assignments based on each member's responsibilities. Regularly review team membership and remove access for members who no longer need it.
-
-For enhanced security, use the principle of least privilege by assigning the minimum role necessary for each team member's work. Consider creating separate accounts for billing management to isolate financial access from technical operations.
+When managing team accounts, regularly review team membership and remove access for members who no longer need it.
 
 Monitor audit logs periodically to ensure compliance with your organization's policies and identify any unauthorized activities early.
 
@@ -126,4 +81,4 @@ After setting up your account and team you can:
 * [Create API keys](/get-started/api-keys) to enable programmatic access to Runpod services.
 * [Deploy your first Pod](/get-started) to start using GPU resources.
 * Configure [Serverless endpoints](/serverless/overview) for scalable AI inference.
-* Set up [billing and payment methods](https://console.runpod.io/user/billing) for your team.
+* Set up [billing and payment methods](https://console.runpod.io/user/billing) for your team.

accounts-billing/organizations/SSH-key-management.mdx

@@ -0,0 +1,202 @@
+---
+title: "SSH key management"
+sidebarTitle: "SSH key management"
+description: "Centrally manage SSH public keys for your organization so members can securely connect to Pods."
+tag: "NEW"
+---
+
+Organization-level SSH key management lets org admins store and manage SSH public keys in one place. When a member launches a Pod, org-managed keys are automatically injected into it — no per-member SSH setup required.
+
+This is useful for teams that need consistent, auditable SSH access across all Pods, and makes it easy to revoke access org-wide when a member leaves.
+
+---
+
+## Roles and permissions
+
+SSH key management is controlled by org roles.
+
+</* [CONFIRM: Exact role permissions for SSH key management. Which roles can add/delete org keys vs. which roles can only use them? Align with DOCS-481 role matrix before publishing.] */
+
+| Action | Owner/Admin | Member | Billing | Read-only |
+|---|---|---|---|---|
+| Add an org SSH key | ✅ | ❌ | ❌ | ❌ |
+| Delete an org SSH key | ✅ | ❌ | ❌ | ❌ |
+| Rename/manage org keys | ✅ | ❌ | ❌ | ❌ |
+| Use org keys to connect to Pods | ✅ | ✅ | ❌ | ❌ |
+
+<Note>
+Members can still add personal SSH keys to their own account in addition to org-managed keys. See [Personal vs. org keys](#personal-vs-org-keys) for how these interact.
+</Note>
+
+---
+
+## Adding an SSH key
+
+### Step 1: Generate a key pair
+
+If you don't already have an SSH key pair, generate one on your local machine. Runpod only stores the **public key** — never paste your private key anywhere.
+
+<Tabs>
+  <Tab title="macOS / Linux">
+    ```bash
+    ssh-keygen -t ed25519 -C "your-name@yourorg.com"
+    ```
+
+    When prompted, accept the default file location (`~/.ssh/id_ed25519`) or specify a custom path. To view your public key:
+
+    ```bash
+    cat ~/.ssh/id_ed25519.pub
+    ```
+  </Tab>
+  <Tab title="Windows (PowerShell)">
+    ```powershell
+    ssh-keygen -t ed25519 -C "your-name@yourorg.com"
+    ```
+
+    When prompted, accept the default file location. To view your public key:
+
+    ```powershell
+    Get-Content "$env:USERPROFILE\.ssh\id_ed25519.pub"
+    ```
+
+    If `ssh-keygen` is not available, install [OpenSSH for Windows](https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse) or use [PuTTYgen](https://www.puttygen.com/).
+  </Tab>
+</Tabs>
+
+Your public key will look like:
+
+```
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... your-name@yourorg.com
+```
+
+### Step 2: Add the public key to your org
+
+/* [CONFIRM: Exact navigation path to SSH key management in org settings. E.g., Settings > Organization > SSH Keys? Please verify.] */
+
+1. Open the [Runpod console](https://console.runpod.io) and navigate to **Settings → Organization → SSH Keys**.
+2. Click **Add SSH key**.
+3. Paste your public key into the field.
+4. Give the key a name (for example, `alice-macbook` or `ci-deploy-key`) so it's easy to identify later.
+5. Click **Save**.
+
+The key is now available to all Pods launched by members of your org.
+
+---
+
+## Managing keys
+
+To view, rename, or delete org SSH keys:
+
+/*  [CONFIRM: Exact UI path and available actions (rename, delete) for managing org SSH keys.] */
+
+1. Navigate to **Settings → Organization → SSH Keys**.
+2. Find the key you want to manage.
+3. To rename it, click the key name and edit it inline.
+4. To delete it, click the three-dot menu next to the key and select **Delete**.
+
+<Warning>
+Deleting an org SSH key immediately revokes access for all org members using that key. Members connected to a running Pod via that key will be disconnected. New Pods will not have the key injected.
+</Warning>
+
+/*  [CONFIRM: Does deleting a key affect currently running pods immediately, or only new pods going forward? The above assumes immediate revocation — please verify.] */
+
+---
+
+## Key scope and membership
+
+**New Pods** launched after a key is added automatically have all current org SSH keys injected at startup.
+
+**Existing running Pods** do not receive newly added keys unless they are restarted.
+
+/*  [CONFIRM: Confirm whether org keys are injected into existing running pods or only at pod creation time.] */
+
+### Personal vs. org keys
+
+Members can maintain personal SSH keys in their individual account settings in addition to org keys. Both sets of keys are injected into Pods the member launches. Either key can be used to connect.
+
+If a member is removed from the org, their org key access is revoked, but their personal keys are unaffected.
+
+---
+
+## Connecting to a Pod
+
+Once an org SSH key is set up, any member whose private key matches an org public key can connect to a Pod.
+
+### Find the connection details
+
+1. Open the [Pods page](https://console.runpod.io/pods) and expand the Pod you want to connect to.
+2. Click **Connect** to view the SSH connection string.
+
+### Basic SSH
+
+```bash
+ssh root@<pod-ip> -p <port> -i ~/.ssh/id_ed25519
+```
+
+Replace `<pod-ip>` and `<port>` with the values shown in the console.
+
+### SSH over exposed TCP
+
+If the Pod exposes SSH over a TCP proxy (common for Secure Cloud Pods):
+
+```bash
+ssh root@<proxy-host> -p <proxy-port> -i ~/.ssh/id_ed25519
+```
+
+The proxy host and port are shown in the **Connect** dialog in the console.
+
+<Tip>
+To avoid specifying the identity file every time, add an entry to your `~/.ssh/config`:
+
+```
+Host runpod-mypod
+    HostName <pod-ip>
+    Port <port>
+    User root
+    IdentityFile ~/.ssh/id_ed25519
+```
+
+Then connect with: `ssh runpod-mypod`
+</Tip>
+
+---
+
+## Troubleshooting
+
+**Permission denied (publickey)**
+
+- Confirm that the private key on your machine matches a public key stored in org settings.
+- Verify the key was added before the Pod was launched. Org keys are only injected at Pod startup — restart the Pod if you added the key after it was created.
+- Check that you're using the correct private key file with `-i ~/.ssh/id_ed25519`.
+
+**Connected to wrong Pod / unexpected behavior**
+
+- Double-check the IP and port from the console. These change each time a Pod is restarted.
+
+**Key not propagated to Pod**
+
+- Org SSH keys are injected at Pod creation time. If you added the key to org settings after the Pod launched, you must restart the Pod for the key to take effect.
+
+**Member cannot connect after joining the org**
+
+- The member needs to provide the private key for one of the org's public keys. Verify they have the corresponding private key for a key stored in org settings.
+
+**Access not revoked after removing a member**
+
+- Removing a member from the org revokes their org key access. However, if the member had a personal SSH key added to a Pod before joining the org, that key remains on the Pod. Audit Pod-level keys if you need to ensure full revocation.
+
+/*  [CONFIRM: How exactly does member removal interact with key injection? Is org access revoked from running pods immediately, or only for new pods?] */
+
+---
+
+## Security notes
+
+**Only store public keys.** Never paste a private key into Runpod. Your private key should remain only on the machine you use to connect.
+
+**Use strong key types.** Ed25519 (`-t ed25519`) is recommended. RSA keys should be at least 4096 bits (`-t rsa -b 4096`). Avoid DSA and ECDSA with short curves.
+
+**Rotate keys regularly.** If a key may be compromised, delete it from org settings immediately and generate a new key pair. Affected members will need to add their new public key.
+
+**Offboarding members.** When a member leaves the org, remove their key from org settings to revoke SSH access. If they shared a key with others, replace it with a fresh key pair distributed only to current members.
+
+**Audit keys periodically.** Review your org's SSH keys in **Settings → Organization → SSH Keys** and remove any keys that are no longer in active use.

accounts-billing/organizations/overview.mdx

@@ -0,0 +1,21 @@
+---
+title: "Organizations"
+sidebarTitle: "Overview"
+description: "Manage teams, access, and resources across your Runpod organization."
+---
+
+Organizations let you collaborate with your team on Runpod. Members share access to resources, and admins control who can do what through roles and permissions.
+
+## What you can manage
+
+**Roles and permissions** — assign roles to org members to control access to pods, endpoints, billing, and org settings. See [Roles and permissions](/organizations/roles-and-permissions).
+
+**SSH key management** — store SSH public keys at the org level so all members can securely connect to Pods without individual key setup. See [SSH key management](/organizations/ssh-key-management).
+
+**Resource tagging** — create and apply key/value tags to Pods, Endpoints, Network Volumes, and Clusters to organize resources by team, project, or environment. See [Resource tagging](/organizations/resource-tagging).
+
+## Managing your organization
+
+To manage your organization's members and settings, navigate to **Settings → Organization** in the [Runpod console](https://console.runpod.io).
+
+/* [CONFIRM: Is the org settings path Settings → Organization, or something else in the console?] */