Team and roles

A workspace holds your sites, team, API tokens and settings. Team membership belongs to the workspace, not to one site: an editor is an editor everywhere in it. One person can belong to several workspaces and switch between them.

The three roles

Roles apply to API tokens too. A site token acts as an editor for its one site; an account token acts as an owner. See API tokens and roles.

Inviting someone

Open Site settings › Team, enter an email address and choose editor or viewer. They get an email with a link that works for seven days. Only an owner can send invitations.

An invitation can only be sent as editor or viewer. To make someone an owner, invite them first and change their role once they have accepted.

Note. The person accepting must sign in with the exact address the invitation was sent to. A different address gets “Invite was sent to a different email”.

Expired or lost invitations

There is no resend button. Invite the same address again and a fresh link is sent; the old link stops working at that moment. A workspace can hold 25 pending invitations at a time and send 30 a day.

Changing a role or removing someone

Owners can change any member’s role from the members table, and remove a member with the remove action. Removal takes effect immediately and there is no confirmation step, so read the row before you click.

A workspace always keeps at least one owner. Demoting or removing the last one is refused with “An organization needs at least one owner”. Promote someone else first.

What only a signed-in person can do

Changing the team, managing API tokens and everything to do with billing require a real signed-in session. API tokens are refused with 403 session_required, and site tokens cannot reach workspace settings at all. This is deliberate: a leaked token cannot be used to add someone to your team or mint another token.