Workspaces
Belonging to more than one workspace, switching between them, and what an invitation actually grants.
What a workspace is
A workspace is the account: the subscription, the encryption key everything inside it is wrapped by, the member list, and the audit log. It is called an organization in the API and the database, and a workspace everywhere a person sees it.
Workspaces share nothing. No key material, no memberships, no audit entries cross between them. A flaw that exposed one workspace's master key would expose nothing about any other.
Belonging to several
One account, many workspaces - your own, and any you have been invited into. The switcher in the sidebar moves between them, the same way a Vercel or GitHub scope does.
Your choice is stored on your account rather than in the session, so it follows you between devices. It is a preference, never an authority: membership is re-checked on every read, and losing access to a workspace you were pointed at drops you back to another one you do belong to rather than into an error.
Creating another
Workspaces → New workspace. You are moved into it once it is created.
How many you may own comes from the most capable plan among the workspaces you already own - so paying for one is what buys the right to more. Free includes one.
Slugs are checked for availability as you type, and a set of reserved words - admin, api, docs, login, and so on - are refused outright rather than left to collide with a route or a hostname later.
Invitations
An invitation is an offer, not a membership. It arrives by email with a link, and grants nothing until it is accepted.
Offers expire after seven days by default. A standing key to someone else's infrastructure should not sit in a mailbox indefinitely.
Only a hash of the token is stored. The link in the email is the only copy, so a database compromise does not yield working invitations.
Declining and revoking are recorded as different facts, because "they said no" and "we withdrew it" are different things.
Re-inviting or resending revokes the outstanding offer first. Two live tokens for one seat makes "revoke the invitation" ambiguous exactly when it is urgent.
Pending offers appear on your workspaces page. Accepting one adds the membership immediately and switches you into it.
Leaving
Leaving a workspace removes your membership and nothing else. Secrets you created stay, audit entries naming you stay - an audit log you can erase by leaving is not an audit log.
An owner cannot leave a workspace that would be left with no owner. Transfer ownership first, or delete the workspace.
Something here wrong or missing? Tell us.