Team & security
Team members, roles and invitations
Invite people, understand Owner, Admin, Developer and Viewer permissions, manage seats, require two-factor authentication, and switch workspaces.
Roles
| Permission | Viewer | Developer | Admin | Owner |
|---|---|---|---|---|
| View apps, deployments, logs | Yes | Yes | Yes | Yes |
| Deploy, roll back, restart apps | Yes | Yes | Yes | |
| Domains, env vars, databases, storage, web terminal | Yes | Yes | Yes | |
| Members, invitations, billing, plan changes | Yes | Yes | ||
| GitHub connection, Git credentials, registries, notifications, workspace API tokens | Yes | Yes | ||
| Require 2FA, rename workspace | Yes | Yes | ||
| Delete the workspace | Yes |
The workspace creator is Owner. Team → Roles & permissions shows your role. Blocked actions explain why, e.g. "your role (viewer) is read-only — ask an admin for developer access".
Invite people
- Team → Invite people (admins, owners): Email and Role. You can invite only roles below yours; owners can invite any role.
- MarvX emails the link and shows it under Invitation ready to copy.
- The invitee signs in or signs up with that email and accepts.
Invitations expire after 7 days. Pending invitations: Create new link (old one stops working) or Revoke.
Seats
Team members per plan: Free 1, Starter 3, Pro 5, Enterprise unlimited. Paid plans can add an Extra team seat ($6/month each) in Billing → Add-ons. A full workspace refuses acceptance: "this workspace has no free seats on its plan — ask an admin to upgrade".
Change roles or remove members
From a member's menu, admins can change roles below their own or Remove from workspace (immediate). Use Leave workspace to leave yourself.
Require two-factor authentication
- Turn on 2FA for yourself (Settings → Security).
- Team → Require two-factor authentication (admins, owners).
Members without 2FA then can't open the workspace ("this workspace requires two-factor authentication — turn it on in Settings → Security"). The member list shows who has 2FA.
Multiple workspaces
If you belong to several workspaces, switch from the account menu in the top bar. Apps, billing and members are separate per workspace.
Key actions (app creation, deployments) are recorded in an audit log, available via GET /v1/orgs/{org_id}/audit-log.