Get started with workspaces and your team
A workspace holds everything you run: its private network, instances, apps, clusters, load balancers, domains and API tokens. Signing up creates a personal workspace for you. A team is a workspace you share: invite people into it, each with a role that decides what they can do, and keep it apart from your own work and from other teams. What one workspace holds and uses never touches another.
Before you start
Teams and invitations come with a paid plan: see Plans and pay as you go. Your personal workspace works on the Free plan.
1. Create a team
Open the workspace switcher and choose Create team. Create a team takes two steps:
- Team name and URL slug: lowercase letters, digits and dashes, used in the console's links, such as
/acme. - Invite teammates (optional): email addresses, each with a role.
Select Create team, or Create team and invite to send the invitations at the same time. On the Free plan, it shows Upgrade to create teams, with See plans, instead.
2. Invite people
Open the workspace's Members and choose Invite member. Enter their Email, pick a Role and select Send invitation. They accept from the link in the email and land in the workspace. Pending invitations, and each member's role, can be changed or removed on the same page.
| Role | Can |
|---|---|
| Owner | Everything, including deleting the workspace |
| Admin | Everything but deleting the workspace: members, networks, domains, load balancers and certificates included |
| Developer | Create, run and delete instances and Kubernetes clusters, create and deploy web apps (deleting one is for owners and admins), and read what the workspace shares |
| Viewer | See what runs, where and how it is doing; never the data or the secrets |
Inside a Kubernetes cluster, what someone can do follows their role on that cluster: see Cluster access. Workspaces & roles has the full table.
3. Require two-step verification
Owners and admins can make every member use an authenticator app or a passkey: Settings → Security → Require two-step verification for every member. Turn it on for your own account first. A member without it can't use the workspace, or its API tokens, until they set it up.
4. Watch the quota
A workspace takes its quota, vCPU, memory and disk, from its owner's plan, and every workspace gets its own. Usage shows what is allocated and used, and Request an increase asks for more.
With PromptOps
PromptOps reads the workspace for anyone in it, within their role:
- "How much of our quota is left?"
- "What did the workspace use this month?"
It never changes members, invitations, roles or ownership: those stay in the console.
With the API or MCP
API tokens and MCP connections never invite, remove or change members either. A token names one workspace, and GET /v1/workspaces reads it:
curl https://api.sahabti.com/v1/workspaces \
-H "x-api-key: $SAHABTI_TOKEN"
Over MCP, whoami names the workspace a connection acts in and what it may do there.
What it costs
A workspace costs nothing on its own: what runs in it is billed to its billing owner. See Billing and the pricing page.
First checks
- Members lists each person with the role you meant.
- A teammate who accepted sees the workspace in their switcher.
- Usage shows the quota you expect.
Next steps
- Workspaces & roles: every role, quota, and deleting a workspace
- Your account: passwords, passkeys, two-step verification and sessions
- API tokens: tokens scoped below your own role