Enterprise Setup

Overview

Cekura provides comprehensive Role-Based Access Control (RBAC) to help enterprise teams manage permissions and secure access to your voice AI testing infrastructure. Control who can access what through both the dashboard UI and programmatic API keys. For account protection and organization-wide enforcement, see Two-Factor Authentication.

User Roles (Dashboard)

Cekura supports three membership types for team collaboration through the dashboard interface:

Admin

Full administrative access to all features and settings. Permissions include:

Complete workspace management and configuration
User management (invite, remove, and change member roles)
Billing and subscription management
Create, edit, and delete agents, evaluators, and metrics
Access to all projects and test results
Configure integrations and webhooks
Manage API keys and developer settings
View raw transcripts, recordings, and analytics

Use cases:

Engineering leads and managers
DevOps and infrastructure teams
Account owners

Member

Standard access for developers and engineers building and testing agents. Members only have access to selected projects assigned to them by Admins. Permissions include:

Create, edit, and delete agents, evaluators, and metrics within assigned projects
Run tests and simulations on assigned projects
View test results and analytics for assigned projects
Access raw transcripts and recordings for assigned projects
Configure test profiles and scenarios within assigned projects

Cannot:

Access projects they haven’t been assigned to
Manage billing or subscriptions
Invite or remove team members
Change other users’ permissions
Delete the workspace

Use cases:

Voice AI developers working on specific environments (dev, staging, production)
Team-specific access (e.g., Team A only accesses their projects, Team B only accesses theirs)
QA engineers testing specific product lines
Contractors or external developers with limited scope

Project-based isolation: Use projects to separate environments (dev, staging, production) or teams. Assign Members only to the projects they need access to for enhanced security and organization.

Viewer

Read-only access for stakeholders who need visibility without modification capabilities. Permissions include:

View agents, evaluators, and test results
Access analytics and dashboards
View scrubbed call history
Generate reports

Cannot:

Create or modify any resources
Start tests or make calls
Access raw transcripts or recordings
Manage integrations or settings
View billing information

Use cases:

Product managers
Business stakeholders
Compliance and audit teams

API Key Types

Cekura has two levels of API key, chosen when you create the key. Send the key in the X-CEKURA-API-KEY header on every request.

Organization API Keys

Access across every project in the organization. Security considerations:

Treat as highly sensitive credentials
Rotate regularly (recommended: every 90 days)
Store in secure secret management systems
Limit to backend services only
Never commit to version control

Example use cases:

# List the organization's projects
curl https://api.cekura.ai/user/v1/projects/ \
  -H "X-CEKURA-API-KEY: $CEKURA_ORG_API_KEY"

# List test results across projects
curl https://api.cekura.ai/test_framework/v1/results/ \
  -H "X-CEKURA-API-KEY: $CEKURA_ORG_API_KEY"

Project API Keys

Access limited to one project, chosen when the key is created. Capabilities:

Create and manage agents, evaluators and metrics within the project
Run tests and retrieve results for the project
Send observability data for the project
Access transcripts and analytics for the project

Restrictions:

Cannot access other projects

Security considerations:

Use for development and staging environments
Different keys per project for isolation
Safe to use in CI/CD pipelines

Example use cases:

# Run evaluators in the project
curl -X POST https://api.cekura.ai/test_framework/v1/scenarios/run_scenarios/ \
  -H "X-CEKURA-API-KEY: $CEKURA_PROJECT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"agent_id": 123, "scenarios": [456, 789]}'

# List the project's production call logs
curl "https://api.cekura.ai/observability/v1/call-logs/?project_id=742" \
  -H "X-CEKURA-API-KEY: $CEKURA_PROJECT_API_KEY"

Running evaluators returns a result to poll — see Result statuses and gating.

Best Practices

Team Structure Recommendations

Small teams (1-5 people): Most users can be Members with 1-2 Admins. Create separate projects for dev, staging, and production environments.Medium teams (5-20 people): Use project-based access - assign Members to only the projects they need. For example, create projects per environment (dev/staging/prod) or per team, and grant selective access.Large enterprises (20+ people): Implement least-privilege access with granular project assignments. Use projects to isolate:

Different environments (dev, staging, production)
Different teams or business units
Different product lines or clients
Combine with Viewers for stakeholders and limited Admins for leads

Project-Based Access Patterns

Environment Separation:

Projects: prod-voice-ai, staging-voice-ai, dev-voice-ai
- Production team Members: Access to prod-voice-ai only
- QA team Members: Access to staging-voice-ai and dev-voice-ai
- Dev team Members: Access to dev-voice-ai only

Team Isolation:

Projects: team-a-agents, team-b-agents, shared-resources
- Team A Members: Access to team-a-agents and shared-resources
- Team B Members: Access to team-b-agents and shared-resources
- Contractors: Access to specific team project only

Client/Product Separation:

Projects: client-acme, client-globex, internal-testing
- Client A team Members: Access to client-acme only
- Client B team Members: Access to client-globex only
- Internal QA: Access to internal-testing only

API Key Management

Key Rotation
- Organization keys: Rotate every 90 days
- Project keys: Rotate every 180 days
Storage
- Use environment variables for all API keys
- Store in secret management systems (AWS Secrets Manager, HashiCorp Vault, etc.)
- Never hardcode in application code
- Never commit to version control

Access Patterns

# Production: Use Project API keys
CEKURA_API_KEY=project_api_key_xxx

# CI/CD: Use a Project API key for the test project
CEKURA_TEST_API_KEY=project_api_key_yyy

Monitoring and Auditing
- Track API key usage through activity logs
- Set up alerts for unusual access patterns
- Review permissions quarterly
- Audit key access when team members change roles

Security Checklist

All Organization API keys stored in secure secret management
Project API keys used for development and CI/CD
Regular key rotation schedule established
Team members have minimum required permissions
Viewers assigned for stakeholders without modification needs
API key usage monitored and logged
Keys revoked when team members leave

Managing Access

Adding Team Members

Navigate to Settings

Go to your Cekura dashboard and click on Settings > Team.

Invite User

Click Invite Member and enter their email address.

Assign Role

Select the appropriate role: Admin, Member, or Viewer based on their responsibilities.

Send Invitation

The user will receive an email invitation to join your workspace.

Creating API Keys

Access to Settings > API Keys requires the Admin role. Members and Viewers cannot view or manage API keys. If you do not have Admin access, ask an org admin to create an API key and share it with you.

Access Developer Settings

Navigate to Settings > API Keys in the dashboard.

Generate New Key

Click Create API Key and choose Organization Level or Project Level.

Configure Scope

For a Project Level key, select the project it can access.

Save Securely

Copy the API key immediately - it will only be shown once. Store it in your secret management system.

API keys cannot be recovered if lost. If you lose an API key, you must generate a new one and update all systems using the old key.

Migration Guide

Upgrading from Single API Key

If you’re currently using a single API key for all purposes, follow these steps to implement proper RBAC:

Audit current usage - Identify all systems and services using your current key
Create scoped keys - Generate Project API keys for each service/environment
Update services - Migrate each service to use its dedicated Project key
Rotate the organization key - Generate a new Organization key and update only the systems that need cross-project access
Revoke old key - Once migration is complete, revoke the original key

Support

Need help setting up RBAC for your organization? Contact our enterprise support team at support@cekura.ai or visit our support portal.

Get Started

Key Concepts

Guides

Integrations

Advanced

Enterprise Setup

Overview

User Roles (Dashboard)

Admin

Member

Viewer

API Key Types

Organization API Keys

Project API Keys

Best Practices

Team Structure Recommendations

Project-Based Access Patterns

API Key Management

Security Checklist

Managing Access

Adding Team Members

Creating API Keys

Migration Guide

Upgrading from Single API Key

Support

​Overview

​User Roles (Dashboard)

​Admin

​Member

​Viewer

​API Key Types

​Organization API Keys

​Project API Keys

​Best Practices

​Team Structure Recommendations

​Project-Based Access Patterns

​API Key Management

​Security Checklist

​Managing Access

​Adding Team Members

​Creating API Keys

​Migration Guide

​Upgrading from Single API Key

​Support

Overview

User Roles (Dashboard)

Admin

Member

Viewer

API Key Types

Organization API Keys

Project API Keys

Best Practices

Team Structure Recommendations

Project-Based Access Patterns

API Key Management

Security Checklist

Managing Access

Adding Team Members

Creating API Keys

Migration Guide

Upgrading from Single API Key

Support