Create a workspace and manage access

Create a workspace for your computers and databases, then give a teammate access. You need the CLI installed and signed in. To manage members of an existing workspace, you need its admin role.

Create a workspace

Pick a name you haven't used for another workspace:

nevia workspace create --name team-dev --use
nevia whoami

You are the new workspace's admin. --use saves its ID as your CLI default, though an environment or project selection can override it. See Select a workspace.

Find team-dev in the workspace list, with role admin, and copy its full ID in place of 01d4cnjjq40hnnh0nwmkg35nv2h below. For an existing workspace, copy the ID from whoami:

workspace=01d4cnjjq40hnnh0nwmkg35nv2h
nevia access ls --workspace "$workspace"

The list shows everyone with access: people by email and role, and any principals that sign in with a private key by description. The examples below pass --workspace so each change lands in this workspace.

Add a member

You need the workspace admin role. In place of [email protected], use the email from the person's nevia whoami, or their principal ID. Pick a role from Workspace permissions. Without --role a person joins as a viewer. An editor can create and manage computers and databases:

nevia access add [email protected] --workspace "$workspace" --role editor

If the email belongs to someone who has already signed in, that person joins immediately and receives an email with a link to the workspace. They appear in the access list with role editor:

nevia access ls --workspace "$workspace"

An email without an account gets an invitation instead. The API invites only addresses that are allowed to sign up and rejects the rest. A pending invitation stays valid for NEVIA_INVITE_TTL_DAYS days (14 by default) and takes effect on the person's first sign-in with a verified email. Re-inviting the same address resends the email and updates the role. The invitation carries no secret. It points at the console's sign-in page, and Nevia matches the account by verified email.

In the console, open the workspace's Settings, choose Members, and add the email there.

List invitations

Requires admin. Pending invitations expire after their NEVIA_INVITE_TTL_DAYS window. The list shows pending invitations by default. Add --state all to include expired, accepted and revoked ones:

nevia access invites ls --workspace "$workspace"
nevia access invites ls --workspace "$workspace" --state all

Each row shows the email, role, state, and when the invitation was sent and expires. The console lists the same invitations under Settings > Members in Pending invites, where you can resend or revoke one.

Revoke an invitation

Requires admin. Revoking cancels a pending invitation before anyone uses it. The address can still sign up; it just has no pending invite to this workspace. Pass the invitation ID from the list:

nevia access invites rm --workspace "$workspace" 01d4cnjn1xy3n9dcwtjnxbxhf15

Confirm when prompted. Command options are in nevia access.

Change a role

To limit someone to inspecting resources, change their role to viewer:

nevia access set [email protected] --workspace "$workspace" --role viewer
nevia access ls --workspace "$workspace"

Their role now reads viewer. Viewers can't run commands on computers or retrieve database passwords.

The API refuses to demote or remove the last admin. Make another member an admin first.

Remove a member

Removing a member ends the access their workspace role granted. Any direct resource grants stay in place.

nevia access rm [email protected] --workspace "$workspace"
nevia access ls --workspace "$workspace"

Confirm when prompted. The member no longer appears in the list.

Command options are in nevia access. To let a script or agent act in the workspace, give it access with a private key. Next, select the workspace or create a database in it.