Organizations

A Radius account identifies you. An organization is the shared boundary for gateway access, credits, billing, usage, models, API keys, provider keys, and routing and rewriting policies.

Every new Radius account starts with a personal organization. You can create more from Your organizations; each new organization is kept separate from the others.

Choosing an organization in Pi

When you run /login radius, Pi opens the Radius website. After signing in, choose the organization that Pi should use and approve access. The resulting login is scoped to that organization:

• Requests consume that organization's credits and limits
• Usage is recorded for the organization and attributed to the user
• Radius-backed tools use the same organization
• The organization's model availability, Auto Model policy, and Token Rewriting policy apply

Run /login radius again when you want to authorize Pi for a different organization.

Inviting people

Open an organization, choose Members, and then Invite a member. Enter the person's email address and the role they should receive. Radius emails an acceptance link that expires after seven days.

The invited person follows the link and signs in on the Radius website. If they do not have a Radius account yet, the invitation lets them create one through Enter Radius during the alpha. Account creation still happens on the website, never in a Pi extension. After they accept, the organization appears in their account and can be selected the next time they authorize Pi.

Pending invitations appear on the Members page. An authorized member can revoke an invitation before it is accepted. Sending another invitation to the same email replaces the existing pending invitation with a fresh link and expiry.

If the browser is signed in with a different email than the invitation recipient, Radius shows both addresses. Switch accounts before accepting if the wrong Radius account is active.

Automatic membership by email domain

An organization owner can configure one email domain under Settings → Automatic membership. Enter only the domain, such as example.com, and save it. Saving a different domain replaces the current one.

Anyone who signs in with a verified email address at that domain is automatically added to the organization. Radius verifies the address through its email sign-in flow or Google sign-in. During the alpha, a matching domain also lets a new user create a Radius account without a signup code or an individual organization invitation.

Radius evaluates automatic membership after every successful sign-in:

• New automatic memberships always receive the member role.
• Existing memberships and roles are left unchanged.
• An existing Radius user is added the next time they sign in.
• If multiple organizations configure the same domain, the user is added to every matching organization. Domains are not exclusive to one organization.

To disable automatic membership, clear the domain and save. Changing or clearing the domain does not remove existing members. If a matching user is removed while the rule remains enabled, they will be added again the next time they sign in.

Roles and membership

• Owners can invite and manage admins and members.
• Admins can invite and manage members.
• Members cannot invite or manage other members.

Owners can change an admin or member's role. Members can leave an organization, and authorized managers can remove them. An organization must retain at least one member, so its last member cannot leave.

Groups and budgets

Owners and admins can create local groups under Groups, assign organization members, and apply one or more budgets to all members or one group. The Groups page is also linked from Members. Each calendar period can have a per-member limit, a shared-pool limit, or both. Daily, weekly, and monthly limits may all apply at the same time; every matching limit must have capacity for a request to proceed.

Per-member usage combines a person's OAuth and API-key traffic because organization API keys are attributed to a member. A shared limit combines usage from the entire budget audience. Weekly periods begin Monday at 00:00 UTC, and all periods use UTC. Newly created budgets start counting when enabled rather than retroactively counting earlier usage in the current period.

Radius reserves estimated request cost before contacting a provider and settles the reservation to actual cost afterward. If a limit is exhausted, the gateway error names the budget, identifies whether the per-member or shared pool blocked the request, and reports the exact reset time.

Required two-step verification

Owners and admins can require two-step verification from the organization's Settings page. Before the requirement can be enabled, the person changing the setting and every active organization owner must already have an authenticator app or security key configured.

When enabled, every member—including owners and admins—must have two-step verification configured before Radius allows direct browser-session access to organization pages and private organization artifacts. Account pages and the organization list remain available so a blocked user can configure two-step verification. Removing a user's final authenticator or security key blocks subsequent organization access.

The requirement intentionally does not apply to OAuth authorization, access tokens, refresh tokens, or requests authenticated with organization API keys. API-key management on the organization website is still browser-session access and remains protected.

Note that two-step verification requirements can take a while to take effect. When an organization requires two-step verification, Radius can delay enforcing it for up to 12 hours for existing grants on some resources.

Shared settings and usage

Organization pages provide a single place to manage:

• Credit, invoices, and auto top-up
• Enabled Radius models
• Organization API keys and, when enabled, upstream provider keys
• Current and historical Auto Model, Token Rewriting, and Custom Models policies
• Groups and per-member or shared budgets
• Members, pending invitations, and organization settings
• Aggregate and per-user usage

Because these resources are organization-scoped, changes affect everyone who uses Radius through that organization. Review the selected organization before authorizing Pi or changing a policy.