> ## Documentation Index
> Fetch the complete documentation index at: https://onecli.sh/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# User Provisioning: Add Team Members Programmatically

> Add team members to OneCLI with pre-configured roles, API keys, and project access. Supports programmatic provisioning via the API.

<Info>
  User provisioning is a **cloud-only** feature available on all plans at [app.onecli.sh](https://app.onecli.sh).
</Info>

User provisioning lets organization admins pre-create user accounts before the user signs up. Each provisioned user gets a project, API key, and a claim link. The API key works immediately, and the user can claim the account later.

## How it works

1. An admin provisions a new user (via the dashboard or SDK)
2. OneCLI creates a placeholder user, project, API key, and default agent
3. The admin receives a **claim link** and **API key**
4. The API key is usable immediately, so agents can start making requests
5. When the user visits the claim link, they sign up and the account is linked to their identity
6. Unclaimed provisions expire after **7 days** and are automatically cleaned up

## Provisioning from the dashboard

1. Go to **Team** in the sidebar
2. Click the dropdown arrow next to the **Invite** button and select **Provision new user**

<Frame>
  <img src="https://mintcdn.com/chartdbinc/WHCUe_QwOVJq4JPc/images/provision-dropdown.png?fit=max&auto=format&n=WHCUe_QwOVJq4JPc&q=85&s=2f15645011ad1816ed141cd34e77d63a" alt="Invite split button with Provision new user option" width="2000" height="1198" data-path="images/provision-dropdown.png" />
</Frame>

3. Choose a role (Member or Admin) and whether to skip onboarding, then click **Provision**

<Frame>
  <img src="https://mintcdn.com/chartdbinc/WHCUe_QwOVJq4JPc/images/provision-dialog.png?fit=max&auto=format&n=WHCUe_QwOVJq4JPc&q=85&s=ce37a90016abed7f31aeaeff045ca711" alt="Provision new user dialog with role and skip onboarding options" width="2000" height="1198" data-path="images/provision-dialog.png" />
</Frame>

4. Copy the claim link, API key, user ID, and project ID

<Frame>
  <img src="https://mintcdn.com/chartdbinc/WHCUe_QwOVJq4JPc/images/provision-result.png?fit=max&auto=format&n=WHCUe_QwOVJq4JPc&q=85&s=4faa9baf68385df16d853d23bd01036d" alt="Provision result showing claim link, API key, user ID, and project ID" width="2000" height="1198" data-path="images/provision-result.png" />
</Frame>

Share the claim link with the user and use the API key in your agent configuration.

## Provisioning from the SDK

Requires an API key from an admin or owner account.

```typescript theme={null}
import { OneCLI } from "@onecli-sh/sdk";

const onecli = new OneCLI({ apiKey: "oc_your_admin_key" });

const result = await onecli.provisionProject({
  role: "member",
  skipOnboarding: true,
});

console.log(result.apiKey);    // oc_... (usable immediately)
console.log(result.claimUrl);  // https://app.onecli.sh/claim?token=...
console.log(result.userId);    // placeholder user ID
console.log(result.projectId); // pre-created project ID
```

### Parameters

| Parameter        | Type                  | Default    | Description                                    |
| ---------------- | --------------------- | ---------- | ---------------------------------------------- |
| `role`           | `"admin" \| "member"` | `"member"` | Role the provisioned user will have in the org |
| `skipOnboarding` | `boolean`             | `true`     | Whether the user skips the onboarding wizard   |

### Response

| Field       | Type     | Description                                              |
| ----------- | -------- | -------------------------------------------------------- |
| `id`        | `string` | Provision record ID                                      |
| `userId`    | `string` | Placeholder user ID (becomes the real user after claim)  |
| `projectId` | `string` | Pre-created project ID                                   |
| `apiKey`    | `string` | API key for the provisioned project (usable immediately) |
| `claimUrl`  | `string` | URL the user visits to claim the account                 |
| `expiresAt` | `string` | Expiration timestamp (ISO 8601, 7 days from creation)    |

### API endpoint

You can also call the API directly:

```bash theme={null}
curl -X POST https://api.onecli.sh/v1/team/provisions \
  -H "Authorization: Bearer oc_your_admin_key" \
  -H "Content-Type: application/json" \
  -d '{"role": "member", "skipOnboarding": true}'
```

## Claim flow

When a provisioned user visits the claim link:

1. If not signed in, they're prompted to sign up or log in
2. After authentication, they see a confirmation page with the organization name
3. Clicking **Claim account** links their identity to the provisioned account

<Frame>
  <img src="https://mintcdn.com/chartdbinc/WHCUe_QwOVJq4JPc/images/provision-claim.png?fit=max&auto=format&n=WHCUe_QwOVJq4JPc&q=85&s=e7b69e1e5e6b4bbd3021bced8d86db07" alt="Claim account page showing organization name and Claim account button" width="2000" height="1198" data-path="images/provision-claim.png" />
</Frame>

4. They're redirected to the dashboard with the provisioned org as their active context

If the user already has an OneCLI account, the provisioned project is transferred to their existing account.

## Expiry and cleanup

* Unclaimed provisions expire after **7 days**
* Expired provisions are automatically cleaned up (placeholder user, project, API key, and agent are deleted)
* Cancelled provisions are cleaned up immediately

<Tip>
  The API key works immediately after provisioning. You don't need to wait for the user to claim the account. This lets you configure agents before the user even signs up.
</Tip>