Roles & access
Three roles, invitations, and who can change what.
You can create one organization; you join any others by invitation. Whichever organization you are working in, three roles decide who can act: owner, admin, and member. Owners and admins run the organization — they dispatch runs, hold every credential, and drive agent sessions. Members see the work but do not change it. The dashboard acts in your active organization, the earliest one you joined.
Roles at a glance
| Action | Owner | Admin | Member |
|---|---|---|---|
| View projects, runs, and agent sessions | Yes | Yes | Yes |
| Create a project and set its repository credential | Yes | Yes | No |
| View and manage credentials — repository tokens, provider API keys, environment variables and secrets | Yes | Yes | No |
| Invite a member | Yes | Yes | No |
| Resend an invitation | Yes | Yes | No |
| Cancel an invitation | Yes | Yes | No |
| Change a member's role | Yes | Yes | No |
| Remove a member | Yes | Yes | No |
| Rename the organization | Yes | Yes | No |
| View runner machines | Yes | Yes | Yes |
| Delete a runner machine after its active runs stop | Yes | Yes | No |
| Dispatch a run — from the dashboard, the CLI, or Slack | Yes | Yes | No |
| Act on an agent session — approve, answer, message, request review, rerun, force-stop, archive | Yes | Yes | No |
Owner and admin carry the same access for the listed operations except the owner-role boundary. Member is read-only over the surfaces above, and credentials and environment secrets are not visible to members at all. Only an owner can grant or remove the owner role, and Devboxes refuses to demote or remove the organization's last owner.
Accept an invitation
An organization invitation arrives by email, and opening its link is the acceptance — there is no separate confirmation step and no verification email.
- Open the invitation link.
- If you are new to Devboxes, create your account on the sign-up screen — with GitHub, Vercel, or a password. You land signed in, inside the inviting organization.
- If you already have a Devboxes account with the invited address, sign in when asked and you join immediately. Signed in with a different address? Select Use a different account and sign in with the invited one.
Invitations expire seven days after they are sent. If yours has expired, ask the organization to send a new one.
Owners and admins manage access from Members. Invite member sends a seven-day invitation with the selected role. The same screen lists pending and resolved invitations, and lets an owner or admin resend a fresh link or cancel a pending one. Cancelling makes the current link stop granting access immediately.
Platform administrators
A platform administrator is a separate, platform-level role — not an organization role. Platform admins operate the Users screen, which no organization role can reach: they create users and set each user's platform role there. From a user's detail page they can:
- Ban or Unban a user. Banning prevents sign-in and revokes the user's current sessions.
- Impersonate a user to see the product exactly as that user does.
- Set password, Remove user, and list or Revoke the user's sessions.
A ban takes effect immediately: the user cannot sign in and every active session is revoked. Any short-lived access token the user still holds stops working within 15 minutes.
Two-factor authentication
Two-factor authentication is available from your account settings: pair an authenticator app, save the backup recovery codes, and Devboxes asks for a code at sign-in. See security for the full sign-in and session picture.
Next: Working as a member — what an invited member sees and how to follow the work.