Otherwise the account owner must share the main api secret key and that key have full access to all apis including the permission to create new team members, changing permission and so on because via api the team member can impersonate the account owner.