# Create a workspace and manage access

> Create a workspace, give a teammate access, and change or remove their role

> Nevia is in beta and open to selected teams. Public launch in Dec 2026. The CLI installs with `curl -fsSL https://get.nevia.cloud | sh`, and the MCP server is at https://api.nevia.cloud/mcp. A person signs in once in the browser.
> Setup, sign-in and requesting access: [SKILL.md](https://nevia.cloud/SKILL.md). When Nevia fits and when it doesn't: [why.md](https://nevia.cloud/why.md).

> For the complete documentation index, see [llms.txt](https://nevia.cloud/llms.txt). This page's HTML version: https://nevia.cloud/docs/workspaces/manage

Create a workspace for your computers and databases, then give a teammate access.
You need the [CLI installed and signed in](https://nevia.cloud/docs/get-started/quickstart.md). To manage
members of an existing workspace, you need its admin role.

## Create a workspace

Pick a name you haven't used for another workspace:

```bash
nevia workspace create --name team-dev --use
nevia whoami
```

You are the new workspace's admin. `--use` saves its ID as your CLI default,
though an environment or project selection can override it. See
[Select a workspace](https://nevia.cloud/docs/workspaces/select.md).

Find `team-dev` in the workspace list, with role `admin`, and copy its full ID
in place of `01d4cnjjq40hnnh0nwmkg35nv2h` below. For an existing workspace, copy the ID from `whoami`:

```bash
workspace=01d4cnjjq40hnnh0nwmkg35nv2h
nevia access ls --workspace "$workspace"
```

The list shows everyone with access: people by email and role, and any
[principals that sign in with a private key](https://nevia.cloud/docs/workspaces/private-key-auth.md) by description.
The examples below pass `--workspace` so each change lands in this workspace.

## Add a member

You need the workspace admin role. In place of `dana@example.com`, use the email from
the person's `nevia whoami`, or their principal ID. Pick a role from
[Workspace permissions](https://nevia.cloud/docs/reference/workspace-permissions.md). Without `--role` a person
joins as a viewer. An editor can create and manage computers and databases:

```bash
nevia access add dana@example.com --workspace "$workspace" --role editor
```

If the email belongs to someone who has already signed in, that person joins
immediately and receives an email with a link to the workspace. They appear in the
access list with role `editor`:

```bash
nevia access ls --workspace "$workspace"
```

An email without an account gets an invitation instead. The API invites only
addresses that are allowed to sign up and rejects the rest. A pending invitation
stays valid for NEVIA\_INVITE\_TTL\_DAYS days (14 by default) and takes effect on the
person's first sign-in with a verified email. Re-inviting the same address resends
the email and updates the role. The invitation carries no secret. It points at the
console's sign-in page, and Nevia matches the account by verified email.

In the console, open the workspace's **Settings**, choose **Members**, and add the
email there.

## List invitations

Requires admin. Pending invitations expire after their NEVIA\_INVITE\_TTL\_DAYS window.
The list shows pending invitations by default. Add `--state all` to include expired,
accepted and revoked ones:

```bash
nevia access invites ls --workspace "$workspace"
nevia access invites ls --workspace "$workspace" --state all
```

Each row shows the email, role, state, and when the invitation was sent and
expires. The console lists the same invitations under **Settings** > **Members**
in **Pending invites**, where you can resend or revoke one.

## Revoke an invitation

Requires admin. Revoking cancels a pending invitation before anyone uses it. The
address can still sign up; it just has no pending invite to this workspace. Pass the
invitation ID from the list:

```bash
nevia access invites rm --workspace "$workspace" 01d4cnjn1xy3n9dcwtjnxbxhf15
```

Confirm when prompted. Command options are in
[`nevia access`](https://nevia.cloud/docs/reference/cli/access.md).

## Change a role

To limit someone to inspecting resources, change their role to `viewer`:

```bash
nevia access set dana@example.com --workspace "$workspace" --role viewer
nevia access ls --workspace "$workspace"
```

Their role now reads `viewer`. Viewers can't run commands on computers or retrieve
database passwords.

The API refuses to demote or remove the last admin. Make another member an admin
first.

## Remove a member

Removing a member ends the access their workspace role granted. Any
[direct resource grants](https://nevia.cloud/docs/reference/workspace-permissions.md#direct-resource-grants)
stay in place.

```bash
nevia access rm dana@example.com --workspace "$workspace"
nevia access ls --workspace "$workspace"
```

Confirm when prompted. The member no longer appears in the list.

Command options are in [`nevia access`](https://nevia.cloud/docs/reference/cli/access.md). To let a
script or agent act in the workspace, [give it access with a private key](https://nevia.cloud/docs/workspaces/private-key-auth.md).
Next, [select the workspace](https://nevia.cloud/docs/workspaces/select.md) or
[create a database](https://nevia.cloud/docs/databases/create.md) in it.