Workspaces with members, roles, and their own resources.
What a workspace owns
A workspace is the unit of ownership on inference shell. Apps, agents, flows, knowledge, vaults, secrets, and API keys all belong to a workspace, and the workspace's username is the namespace its published work appears under (acme/report-writer).
Your personal workspace is created with your account and behaves like any other workspace with one member. Shared workspaces add members and roles on top.
Roles
| Role | Can do |
|---|---|
| Owner | Everything, including workspace settings, usage policy, and deleting the workspace |
| Admin | Manage members, billing, secrets, vaults, and the workspace's API keys |
| Member | Use and build with the workspace's resources, and create personal API keys |
Set roles in settings → workspace → members.
On workspaces billed by an organization, owners and admins still manage members and resources, but plans, top-ups, and payment methods live on the organization workspace.
Org owners and admins on the organization workspace also receive owner or admin standing on every member workspace, even when they are not on that workspace's member list.
Inviting people
Workspace owners and admins invite by email from settings → workspace → members. Invitees get an email with accept/decline links; pending invites count toward the workspace size limit.
If the workspace belongs to an organization, invites are bounded by the org perimeter: you can invite people who are already part of the organization (a managed account or a member of another workspace in the org). Bringing in someone from outside the organization requires an org admin, so a workspace inside an org can't become a side door into it.
Accepting an invitation
Invite links open a dedicated page that loads invite details from GET /invites/info (no sign-in required to read them). You can review the workspace, role, and invited email before acting.
- Sign in as the invited address — acceptance requires the authenticated account's email to match the invite. If you're signed in as someone else, use sign out and switch account.
- Pending — sign in (or create an account) as the invited email, then accept or decline.
- Already accepted — open the workspace directly when you're on the right account.
- Expired or withdrawn — ask the inviter to send a new invite from settings → team → members.
- Page didn't load — a transient error shows try again; only a broken or unknown link shows that the URL does not work (the API returns
404for an unknown token).
After you accept, the app refreshes your workspace list, selects the team you joined, and lands you in that workspace.
API keys
A workspace has two kinds of API key. A personal key acts as the member who created it and stops working when they leave. A workspace key acts as the workspace, survives whoever created it, and is created only by owners and admins; use it for CI, servers and other automation. Members see and revoke their own personal keys; owners and admins see and revoke every key. See API keys.
Switching workspaces
The workspace switcher at the top of the sidebar lists your personal workspace, then your organization's workspaces grouped under the organization's name, and any standalone workspaces. Switching reloads the app in the selected workspace's context.
Deleting
Workspace owners can delete a shared workspace from settings → workspace → general. Deleting your account (settings → personal → data & privacy) removes only you and your personal workspace. Shared workspaces you belong to are never touched by account deletion.