Workspaces & roles
A workspace owns everything: its own private network, its instances, and its API tokens. Signing up creates a personal one for you; create more from the workspace switcher when you want to separate a team or a client from your own work.
Members and invitations
Members lists everyone in the workspace. Invite by email and the invitation is sent with a role attached; the recipient accepts it from the link and lands in the workspace. Pending invitations can be revoked from the same page, and you can change or remove a member's role there too.
Membership is per-workspace, so being an owner of one grants nothing in another.
Roles
| Owner | Admin | Developer | Viewer | |
|---|---|---|---|---|
| Create / delete instances | ✓ | ✓ | ✓ | — |
| Start, stop, restart, resize | ✓ | ✓ | ✓ | — |
| Read connection details | ✓ | ✓ | ✓ | ✓ |
| Run SQL & manage database users | ✓ | ✓ | ✓ | — |
| Back up & restore | ✓ | ✓ | ✓ | — |
| Create & deploy projects | ✓ | ✓ | ✓ | — |
| Delete a project | ✓ | ✓ | — | — |
| Mint & revoke API tokens | ✓ | ✓ | ✓ | — |
| Networks and domains | ✓ | ✓ | read only | read only |
| Invite & manage members | ✓ | ✓ | — | — |
| Delete the workspace | ✓ | — | — | — |
Developer is the role for people who build: full lifecycle over the instances they create, including deleting them, plus deploying projects — but no changes to the workspace's shared topology (networks, domains, membership) and no deleting a project outright. Viewer reads everything and writes nothing.
These aren't only UI affordances for instances and tokens: the control plane re-resolves your role on every request and rejects the ones your role doesn't carry, so a hidden button can't be worked around by calling the API directly.
Plan and quota
The plan sits on your account, not on each workspace, and grants the quota that instances are carved out of — vCPU, memory, and disk in one shared pool. It's the account owner's plan that counts for a shared workspace, so an invited developer's own plan doesn't change what the team can launch.
Usage shows the full picture: what's allocated against the quota, what the running instances are actually consuming, and which tier you're on. When you need more, request an increase from the same page — it goes to a review queue, and the page shows the request as pending until it's decided. One pending request at a time.
Notifications
Notifications is the workspace's feed of what the platform did: instances that finished provisioning, ones that failed and on which step, deployments that shipped. It's the place to look when something you started earlier should have landed by now.
Next steps
- API tokens — scope a token to a subset of what your role can do
- Instances — what your team can launch
- Projects — deploying apps from GitHub