A business account with a shared credential
Create a business in Borago Board, verify your domain, invite a colleague and share one provider API key their runs use without ever seeing it.
A business in Borago Board lets a team spend from one provider key without handing the key around. You share it once, each member's runs use it, and you can take it back from everyone in one press. This tutorial sets up a small business with one colleague and one shared key.
You will build
A business with a verified domain, one invited member, and one shared API key that member's projects run on.
You need
- A cloud account, see Cloud sync, browser and phone. Your colleague needs one too.
- The desktop app, signed in to that account. Sharing a key happens only there.
- A provider API key you are willing to share, such as a Claude or OpenAI key.
- Access to your domain's DNS records, for the verification step. It is optional.
Steps
1. Create the business
On the cloud board in a browser, open the profile menu, press Profile, then Businesses. Type a name in New business name and press Create business.
What happens. You become the owner. A business without a verified domain can already invite members and share keys.
2. Verify your domain
Under Verified domains, type your domain, choose TXT record or CNAME record, and press Add domain. The page prints the record to publish, named under _borago-verify on your domain. Publish it at your DNS host and press Check now.
What happens. The domain reads verified once the record is found. If it stays pending, wait for DNS to spread and press Check now again. Every existing account with an email on the domain becomes a managed member after a grace period of 7 days, and each gets an email saying so. A managed member cannot leave the business. Consumer email domains cannot be verified. Skip this step if you only want to share a key.
3. Invite your colleague
Under Members, type their address in invite by email and press Send invite.
What happens. They get an email with a link that expires after 14 days. They open it while signed in to the cloud board with that same address, and see Invite accepted - you joined the business. An invite opened from another account is refused. An invited member is a guest, who keeps full control of their own account and can press Leave business at any time.
4. Your colleague signs in on their desktop
Ask your colleague to sign in to the desktop app with their cloud account once.
What happens. Their desktop is where the shared key is set up. Until it has, they show as pending under the key on the business page.
5. Share the key
In your desktop app, press Saved keys in the top bar. In Shared by a business, press Share with a business. Choose the business, type a Key name your colleague will see, pick the provider, paste the key and press Share key.
What happens. The key is encrypted on your computer before it leaves, and protected so that neither the cloud service nor any one machine can read it alone. Using it needs the cloud to be reachable. A pending member's access completes on its own the next time an admin's desktop is running and signed in.
6. Your colleague links the key
In their desktop app, your colleague opens a project with Edit project, then the AI Auth tab. Under Business shared keys, they pick the key for that provider and save.
What happens. Their runs on that provider now use the shared key instead of any token pasted into the project. They see the key's name, the provider and your business, and never the value. Each use is stamped with its time. Only their desktop uses the value, at the moment a run needs it.
7. Revoke it
On the business page under Shared keys, press Revoke beside your colleague's email, or Revoke key to end everyone's access.
What happens. Access ends at the member's next use. Runs then fall back to the project's own token. A member's machine may already have used the key, so rotate it at the provider to make the revocation final. The page says so after every revocation.
Check it worked
Under Shared keys, your colleague's email shows a last used date after their first run.
What a business does not share
Boards. Each member keeps a separate board, with their own projects, tasks, chats and notes. Joining a business shows nobody's work to anyone else, and no two members ever work on one board. A business shares credentials and administration only.
Where to go next
The full set of controls and limits is in Business accounts.
Related: Business accounts, Secrets and environment variables, Accounts, Security