Workspace and team

A workspace is a team and its projects. Admins and members see every project and every report; a client sees only the sites you give them. Open the workspace's settings from Workspace settings in the account menu under your picture. There are three sections: General (the name, leaving and deleting), Members and Billing.

Inviting a teammate

Under Members, type their email, pick a role and press Send invite. They get a link that:

• works once
• expires after 7 days
• needs no account until they open it; the sign-up form is one step away, and the email that confirms their address brings them back to the invite

Nobody has to be a member to report a bug. The widget is public by design; membership is about who can read reports and triage them.

Sending a second invite to the same address replaces the first link. So does Resend on a pending invite, which mails a new link with the same role and sites; the old one stops working. Cancel takes an invite back.

Roles

The last admin cannot be removed or demoted, so make someone else an admin first. Admins and members leave from Leave workspace under Workspace › General, and the last admin is not offered it for the same reason. A client cannot open the workspace's settings, so a client who wants out asks an admin to remove them.

Clients

A client is the person whose website it is. They review the site, file what they find, and follow what happens to it. They see every report on their sites, whether they filed it, one of your team did, or an anonymous visitor did. Client logins work on every plan, Free included.

They see the whole report: the screenshots, the JavaScript errors, the console lines, the element that was clicked, the environment, and the failed requests, including the captured request and response bodies on a project that keeps them. A reporter's status link shows only a summary. Clients do not see the team's half of the screen. Internal comments stay internal, the related ticket stays hidden, and nothing they can reach shows them your tracker token, your install key, or another client in the same workspace.

Picking their sites is part of the invite, because a client with no sites would sign in to an empty page. Change their sites later from the list under Members. You cannot turn an existing teammate into a client from the role dropdown, because a client needs a list of sites and a dropdown cannot ask for one. Invite them as a client instead.

Notifications follow the same line. A client is emailed about their own sites and nobody else's.

Reviewing a site as yourself

Anything you report from a site while signed in is filed as you, and everything you find in one sitting becomes a single ticket rather than one per finding.

There are two ways to start. Review on the project's Inbox (and on Setup's Try it step) opens the site with your session already attached. Or, on the site itself, open the report form and use On the team? Sign in to file this as yourself. Use that one on a phone or a machine you have not used before, since you do not have to find the dashboard first.

The session lasts 30 days per browser and ends the moment you leave the workspace.

Sign-in only works on an origin listed under allowed origins, or on the project's site URL when that list is empty. On a project with neither, sign-in is refused, because the snippet is public and without one of them there is no way to tell your site from a copy of it on somebody else's.

An allowed origin may be a pattern under a domain you own, such as https://pr-*.preview.acme.com for one review app per pull request, and sign-in then works on every origin the pattern matches. The session goes to the concrete origin that asked, https://pr-12.preview.acme.com, never to the pattern. A browser keeps it per origin, so signing in on one review app does not sign you in on another; expect to sign in once on each.

A pattern under a hosting provider, such as https://*-abc123xyz-ew.a.run.app or https://*-acme-team.vercel.app, accepts reports but never signs anyone in, because anyone can open a site there whose name fits it. Open those review apps with Review instead, which takes any address. The fixed part of a pattern has to be yours, and project settings has the details.

Clients do not get this, because a session makes its holder the reporter and opens the team-only fields.

Letting someone's fixes merge on their own

When a project lets the coding agent merge its own small fixes, an admin decides whose runs may do so in Who may auto-merge, at the bottom of any project's Settings › Auto-merge. It is the same list on every project. Every admin and member is listed there with Fixes may merge on their own, which an admin ticks per person; nobody has it to start with. The tick records whose runs the workspace trusts that far. It is not a role. A member with it can merge no more than the policy allows, and an admin without it waits for a review like anyone else. Clients never have it. Automatic merging is on the Team and Agency plans; on Free the ticks are kept, and every pull request waits for a person.

Pictures

A member is shown as their initials, or as a picture when their address has a Gravatar. Our server looks it up once, at sign-up, and only for accounts. Nobody who reports a bug is looked up anywhere; a reporter's address goes on their report and nowhere else.

Notifications

Everyone gets an email when a report lands in a project they can see, with the title, the page, and a link to the report. For the team that is every project in the workspace, and for a client the sites you picked. A finished review arrives as one email for all its findings, and only the team gets it. Its link is the review's own page, which a client cannot open, so a client finds those findings on their list instead. The reporter is never emailed about their own report twice.

You choose whether to get these at sign-up (on by default), and can change it any time under Email notifications on your Account page, in the account menu under your picture. You change your name there too. The setting is per person, so Account is the same page whichever workspace you are in. It also lists the AI assistants you connected, each with Disconnect (Ask from Claude, ChatGPT or Codex).

More than one workspace

A workspace is a separate team, with its own members and projects. An agency's clients belong in one workspace, each with a client login scoped to their own sites, on every plan. A second workspace is for a team that should not share even a member list with the first. New workspace in the account menu creates one. When you belong to several, the workspace name in the header becomes a switcher, for a client too, who has no projects page to switch from. Your role is per workspace, so someone can be a guest on your sites and run a team of their own.

On the Free plan the one free site is per person, and it covers every workspace you run as an admin. A Free workspace can add a site only while it has none and none of its admins already has a site in another Free workspace. Once one of your Free workspaces has a site, another needs a paid plan for a site of its own. Being a member or a client somewhere else does not count.