# Access control

## Roles

A role is a set of permissions you can assign to people. Each workspace starts with these preset roles:

| Role | Secrets | Management |
|---|---|---|
| Owner | write on every environment | everything; cannot be edited |
| Admin | write on every environment | everything |
| Developer | write on non-production, none on production | service tokens, connections and syncs, share links |
| Viewer | read on non-production | none |
| Deployer | read on every environment | none |
| No default access | none | none |

Admins can edit the presets (except Owner) and create custom roles under **Roles**.

### Permissions

- **Secret access per environment:** `none`, `read` or `write`.
- **Management:** projects, environments, members, roles, service tokens, audit log and share links.

Two management permissions also cover integrations:

| Permission | Also allows |
|---|---|
| Manage service tokens | Connecting Vercel and GitHub (workspace role) and adding [syncs](/docs/syncs) to a project (workspace or project role). Syncs copy values out of envpass, like tokens do. |
| Read the audit log | Managing [webhooks](/docs/webhooks), which report who changed which keys. |

Nobody can create, edit or assign a role that grants more than they hold themselves.

## Workspace role and project roles

Every member has a **workspace role**, which applies to all projects. A member can also have a **project role** on a specific project, which replaces the workspace role inside that project: secret access per environment, service tokens and syncs, and share links.

This lets you, for example, give a contractor **No default access** in the workspace and **Developer** on one project.

## Sharing a single project

Open **Project → Access** and click **Share project**:

- If the person is already a member, they get the chosen role on this project.
- If not, they receive an email invitation. They join the workspace with **No default access** plus the chosen role on this project, so they see nothing else.

The same is available over the API:

```bash
curl -X POST "https://envpass.dev/api/v1/workspaces/$WS/projects/$PROJECT/share" \
  -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" \
  -d '{"email":"contractor@example.com","roleId":"'"$ROLE_ID"'"}'
```

## Invitations

Invitations are sent by email and expire after 7 days. The invited person must sign in with the invited email address and verify it before accepting.

## Removing people

Removing a member revokes their access immediately. Service tokens they created stop working at the same time. The removal dialog shows how many and offers to transfer them to another member first.

Syncs run with the permissions of the person who set them up. If that person is removed or loses read access to the environment, their syncs stop with an error. Delete each one and set it up again as someone who still has access. Their personal overrides stay invisible to everyone else.