Team and invitations

Projects can have several developers. Owners and admins invite teammates by email from the console, and each member gets a project role.

Invite a teammate

Open Team in a project. It lists Members and, for owners and admins,Pending invitations.

1. Select Invite member, enter the teammate's Email address, choose aRole (owner, admin or viewer), and select Send invitation. Only owners can invite admins and owners.
2. auth4.dev emails a link that is valid for seven days. Repeating the same invitation while it is pending sends no second email. If the address already has an invitation with another role, revoke it first.
3. The invitation appears under Pending invitations until it is accepted.

The response is the same whether or not the address already has a console account, so invitations can't be used to find out who uses auth4.dev.

Accept an invitation

1. Open the link in the email. It goes to the console.
2. If you're signed in, the page shows your address. Select Accept invitation. If you're signed in with another address, Use a different account signs you out so you can switch.
3. If you aren't signed in, Sign in to accept signs you in with an email code and then accepts the invitation.

The console account's verified email address must match the invited address. An invitation that was revoked, already used, expired or sent to another address shows the same "invalid" message.

Roles

What each role can do in the rest of the project is described under Project roles.

• Change role makes a member an owner, admin or viewer. A project can have several owners.
• Transfer ownership makes another member an owner and makes you an admin in the same step. The console asks you to confirm first. Afterwards only an owner can make you an owner again.
• An owner invitation works only while the owner who sent it is still an owner of the project.
• A project always keeps at least one owner: the last owner can't be removed, demoted or leave.
• Remove ends a member's access on their next request. Leave projectremoves yourself. Pending invitations sent by a removed member stop working.
• Revoke cancels a pending invitation. An accepted invitation can't be revoked.

Audit and privacy

• Every invitation, acceptance, revocation, role change, ownership transfer and removal is recorded in the project's Audit log, including refused attempts. Audit entries never contain email addresses or invitation links.
• The invitation link carries its token after #, so it never reaches a server log. The console removes it from the address bar as soon as the page loads and keeps it only in page memory. auth4.dev stores only a hash of the token.
• The email subject never includes the project name. The message names the project, the role and the expiry date.
• Invitations are rate limited per inviter, per project and per invited address. When a limit is hit, the console asks you to wait and try again.