# Business accounts How to create a business on the cloud board, verify a domain, invite members and share an AI provider key that members use without ever seeing it. A business in Borago Board is a group of accounts that share credentials and, once a domain is verified, are administered together. What it does not share is work. Every member keeps their own board, their own projects and their own tasks. A business gives a team one API key to spend from and one place to take it back. ## Goal A business with members, a verified email domain if you want to manage accounts on it, and a provider key each member's runs use without the member ever seeing it. ## Before you start - A cloud account, see [Cloud sync, browser and phone](/docs/guides/cloud-sync-browser-and-phone/). Management happens on the cloud board in a browser. Sharing a key happens in the desktop app. - Access to the DNS records of your domain, if you intend to verify it. - A provider API key you are willing to share, see [Choosing an AI provider](/docs/guides/choosing-an-ai-provider/). ## Steps 1. **Open the Businesses page.** In the cloud board, open the profile menu in the top bar, press **Profile**, then **Businesses**. The page lists every business you belong to, with your role. It also opens in the desktop app, where it lists your memberships and explains that management runs on the cloud board. 2. **Create the business.** Type a name in **New business name** and press **Create business**. You become its owner. A business with no verified domain can already invite guests and share keys. It just manages nobody. 3. **Invite a member.** Under **Members**, type an address in **invite by email** and press **Send invite**. The person receives an email with a link that expires in 14 days. They open the link while signed in to the cloud board with that same address, creating an account first if they have none. An invite accepted from a different account is refused. An invited member is a guest. A guest keeps full control of their own account, can press **Leave business** at any time, and can remove a shared key from their own use. 4. **Give an admin a role.** Beside a member, **Make admin** and **Make member** switch the role and **Remove** ends the membership. Admins can invite, verify domains and share keys. Only the owner can remove an admin. 5. **Verify a domain.** Under **Verified domains**, type the domain, pick **TXT record** or **CNAME record**, and press **Add domain**. The page prints the record to publish, a name under `_borago-verify` on your domain with the value to set. Publish it at your DNS host, then press **Check now**. There is no website meta tag or file method. Consumer email domains and shared hosting suffixes cannot be verified, and a domain already verified by another business is refused. 6. **Understand what verification does.** Every existing account whose email is on the domain becomes a managed member after a 7-day grace, and each receives an email saying so, with the way out, which is moving to a personal email. A managed member cannot leave the business or remove its shared keys. Verified domains are re-checked daily. After 14 days of failing checks the domain drops to failed and management rights lapse with it. 7. **Share a key from the desktop app.** Open Settings, then Keys & credentials, then **Manage** under **Saved keys**. In the **Shared by a business** section press **Share with a business**. Pick the business, type a **Key name** that members will see, pick the provider, paste the value and press **Share key**. The key is encrypted on your machine before it leaves. Neither the cloud service nor any single device can read it alone. A member whose desktop has not signed in to the cloud yet shows as pending on the business page. The grant completes on its own once that desktop has signed in and an admin's desktop is next online. 8. **Use the shared key in a project.** As a member, open a project with **Edit project**, then the **AI Auth** tab. Under **Business shared keys**, pick the key for the provider. The choice saves from any surface, and the value is fetched by the desktop at the moment a run needs it and never stored there. A linked key wins over a token pasted into the project. If the key is revoked or the cloud cannot be reached, runs fall back to the project's own token. A key that is no longer available still shows as **Linked key (no longer available)** so you can unlink it. 9. **Know what a member sees.** A member sees the key's name, the provider and the business that shared it, in the key vault and on the AI Auth tab. The value is never shown anywhere. A member's machine holds the value in memory only while a call is being made, so the guarantee is that the app never shows it, not that a determined member could never obtain it. Every use is stamped with its time and recorded in the business audit log. 10. **Revoke.** On the business page under **Shared keys**, each key lists its grants with the member's email and last use. **Revoke** ends one member's access and **Revoke key** ends everyone's. Revocation takes effect at the member's next use. A member may already have used the key, so rotate it at the provider afterwards to make the revocation final. The page says so after every revocation. ## Boards are never shared Joining a business changes nothing about what each member sees. Two members do not work on one board, cannot see each other's projects, tasks, chats or notes, and never will through a business. A business shares credentials and administration. Nothing else. ## If it did not work - **The invite link says it could not be accepted.** Sign in with the exact address the invite was sent to. Invites expire after 14 days, so ask for a new one. - **Check now leaves the domain pending.** DNS changes take time to spread. Confirm the record name and value match what the page printed, wait, and press **Check now** again. - **A member is still pending under a shared key.** Their desktop app must sign in to the cloud once. The grant completes the next time an admin's desktop is online. - **Share with a business is disabled.** Sharing runs only in the desktop app, because a credential is encrypted only on the desktop. Open the key vault there. Related: [Secrets and environment variables](/docs/guides/secrets-and-environment-variables/), [A business account with a shared credential](/docs/tutorials/business-account/), [Accounts](/docs/reference/accounts/), [Security](/security/)