Getting started

Access control

Roles, permissions per environment, project sharing and invitations.

Roles

A role is a set of permissions you can assign to people. Each workspace starts with these preset roles:

Role	Secrets	Management
Owner	write on every environment	everything; cannot be edited
Admin	write on every environment	everything
Developer	write on non-production, none on production	services, tokens, share links
Viewer	read on non-production	none
Deployer	read on every environment	none
No default access	none	none

Admins can edit the presets (except Owner) and create custom roles under Roles.

Permissions

Secret access per environment: none, read or write.
Management: projects, services, environments, members, roles, tokens, audit log and share links.

Nobody can create, edit or assign a role that grants more than they hold themselves.

Workspace role and project roles

Every member has a workspace role, which applies to all projects. A member can also have a project role on a specific project, which replaces the workspace role inside that project.

This lets you, for example, give a contractor No default access in the workspace and Developer on one project.

Open Project → Access and click Share project:

If the person is already a member, they get the chosen role on this project.
If not, they receive an email invitation. They join the workspace with No default access plus the chosen role on this project, so they see nothing else.

The same is available over the API:

Terminal

curl -X POST "https://envpass.dev/api/v1/workspaces/$WS/projects/$PROJECT/share" \
  -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" \
  -d '{"email":"contractor@example.com","roleId":"'"$ROLE_ID"'"}'

Invitations

Invitations are sent by email and expire after 7 days. The invited person must sign in with the invited email address and verify it before accepting.

Removing people