Heroku - 6 Permission Heroku
This lesson is about Heroku permissions: what a user is allowed to do on an application, how to change what they can do, and how to make sure the right people see the right content. If you have any administrative responsibility on a Heroku application, this lesson matters for you. Heroku splits permissions into two worlds: the free permission set, which you get by default, and the Teams (paid Enterprise) set, which is much more granular.
Free plan: owner + collaborators
On the free plan, every application has an owner — the person who created the app. The owner can invite collaborators, who get almost the same powers: they can change code, add or remove add-ons, edit config vars, restart dynos, and so on. The two things collaborators cannot do are deleting the application and touching paid add-ons. That is very coarse-grained: at any larger scale (a real company), you want something stricter, which is exactly what Heroku Teams provides.
Heroku Teams: three roles
The first change with a Team is that being a member of the Team does not give you full control over every application. Heroku separates people from apps; for example you may have a front-end app and a back-end app as two distinct applications in the Team. A front-end engineer invited to the front-end app sees nothing on the back-end app. Teams define three predefined roles:
- Admin — like the owner: full access, can delete apps, manage paid add-ons, change other people's permissions. A Team can have several admins.
- Member — can see all the applications and the other members of the Team, and can create new apps for the Team. By default a Member cannot change the code or settings on apps they were not granted access to.
- Viewer — read-only on applications they can see. No access to other users' details, no access to general Team information.
Per-app permissions: View / Deploy / Operate / Manage
On top of Team roles, Heroku defines four per-app permission levels:
- View — see information about the app: other users, activity log, code changes, errors.
- Deploy — fetch and change the code the app runs; access config vars and free add-ons.
- Operate — everything Deploy can do, plus access to paid add-ons, restarting the app and managing dynos.
- Manage — full control: add or remove users, change their permissions, rename the app, change the owner, delete the app. Effectively an admin scope on that application.
To recap: the free plan is straightforward but coarse (one owner, all-powerful collaborators). Teams hold many apps, permissions are managed per app, and each Team member is an Admin, a Member (limited) or a Viewer (very limited). See you in the next lesson.
Summary
This lesson covers Heroku permissions management for controlling user access to applications. The free version allows owners to add collaborators with near-complete access except for deleting apps or managing paid add-ons. Enterprise teams offer significantly better permission control with distinct roles (Admin, Member, Spectator) and four granular application-level permissions (View, Deploy, Operate, Manage).
Key points
- Free tier: Collaborators gain almost complete access to applications once invited, with only deletion and paid add-on management restricted to the owner.
- Team-based permission model: Users invited to one application in a team do not automatically access other team applications, enabling separation of concerns across your infrastructure.
- Three default team roles: Admin (full control), Member (can create apps but limited code access by default), and Spectator (view-only access to applications).
- Four application-level permissions: View (see app info and activity), Deploy (change code and configuration), Operate (deploy + paid add-ons + dyno management), and Manage (user management, app settings, and deletion).
- Admin role allows managing multiple applications and controlling individual permissions per team member, making it suitable for large organizations.
FAQ
Can a collaborator in the free version delete an application?
No. Collaborators in the free version cannot delete applications or touch paid add-ons, even though they have access to almost everything else including code, configuration, and basic add-ons.
What is the main difference between free and enterprise team permissions?
Free version grants collaborators near-complete access once added, with minimal restrictions. Enterprise teams allow fine-grained per-application permission control with distinct roles and four permission levels, giving you much better control in larger organizations.
What can users do with Operate permission versus Manage permission?
Operate permission allows access to paid add-ons, restarting applications, and managing dynos, while Manage permission controls user access, application settings (name and owner), and the ability to delete the entire application.