Workspaces

What a workspace is

Every sign-in belongs to at least one workspace; a solo account is a workspace of one. Owners and members see the same boxes and spend the same balance (the dashboard's Boxes page lists your own first, with the rest folded under Team: Dashboard: Boxes); a contractor sees only the boxes they own. Roles, policies, and the rest of what a team gets are on Teams.

Create one

Your first sign-in creates one, named after your company domain or after you. Rename it under Dashboard → Settings → General, where the owner can also claim your email domain, with two switches:

• Any user with an @yourdomain email can join without approval. New sign-ins with a provider-verified address on the domain land in your workspace instead of an empty one. A personal mail domain (Gmail, Outlook, and the like) can never be claimed.
• Restrict membership to only users with an @yourdomain email. The invite link admits only addresses on the domain.

A domain belongs to one workspace: if a colleague claimed it first with joining open, your first sign-in lands you in theirs, and prized login prints ✓ signed in as you@yourdomain.com · Acme (shared).

Invite people

Dashboard → Settings → Members shows the invite link: anyone who opens it and signs in becomes a member (the owner can then make them a contractor). New link replaces it, and the old one stops working at once. Teammates on a claimed domain with joining open need no link.

Switch between workspaces

Click the workspace name at the top of the sidebar, then Switch workspace. Everything there, API keys included, is scoped to the current workspace.

Remove someone

Dashboard → Settings → Members → Remove (owner only). Their dashboard access ends at once, and every credential they created for this workspace is revoked: API keys (prized on their machine and their scripts stop working), unused install links, and any phone access password. The invite link is replaced, so their copy cannot let them back in; boxes, secrets, and the balance stay.

Their boxes, like a leaving member's, stop receiving new AWS identity tokens. The domain never readmits a removed member, even with joining open; only a link shared after the removal does.

A member can leave from their own row (the link is not replaced); the owner cannot leave.

API keys

Dashboard → Settings → API keys lists every key in this workspace. An API key (dcp_…) acts as the member who made it, with their role, from the CLI or any script (API). A key is shown once; only its hash is stored. Each row shows what the key can do, when it expires, its last use, and its requests over the last 30 days.

• One per machine. prized login makes a key named after the machine; its row shows the CLI version it last reported, and whether it registered an SSH key for Claude Desktop remote. A machine's key never expires while you use it; after 180 days unused it expires, and prized asks you to sign in again.
• One per script or agent. New key asks for a name, what the key may do, when it expires and which boxes it reaches, then shows it once, with a copy button; make one for each script so you can revoke it alone.
• One per agent sign-in. The key a coding agent got when it made your account with an emailed code (Agent sign-in) is listed by the agent's name and marked as an agent's key: boxes write, workspace read, no secrets or sandboxes, for 90 days. It has Revoke but no Rotate (a new secret would cut the agent off).

What a key can do

New key asks for the key's access, and each key's row shows it:

• Full access (the default, and every key prized login makes): everything you can do in the workspace.
• Read only: it can look at everything you can see and change nothing.
• Custom: set Boxes (boxes, snapshots, environments, shared ports), Secrets (secrets and which boxes get them) and Workspace (settings, members, team activity, the audit log, billing) each to None, Read, or Write (write includes read). Connecting to a box, and running commands or moving files on one, need Boxes: Write.

A key never does more than your role allows; access only narrows it. A key cannot make, rotate or revoke other keys, whatever its access. A call outside its access gets 403 key_access_denied, with a message naming what the key lacks. To change a key's access, make a new key and revoke the old one.

When a key expires

New key picks a lifetime: 7, 30 or 90 days (the default), or a year; the workspace owner can also pick No expiry. From then on an expired key gets 401 token_expired on every request, its tunnels end with it, and its SSH key leaves your boxes. A row's light turns amber in the key's last week and red once it has expired; revoke an expired key to clear it from the list.

• Machine keys from prized login expire only after 180 days unused, as above.
• Older keys, made before keys had lifetimes, never expire and cannot be rotated: replace one with a new key.

Limit a key to some boxes

New key → Boxes → Only some limits a key to the boxes you tick (up to 50; a contractor ticks only their own). Such a key:

• Can list, read, wake, pause, resize, move and delete those boxes, connect to them, run commands, move files and prompt agents there, share their ports, and snapshot them.
• Sees nothing else: any other box answers 404 not_found, as if it did not exist, and lists leave it out.
• Cannot reach the whole workspace: creating boxes, forks and templates, secrets, environments, sandboxes, team activity, the audit log and workspace settings answer 403 key_access_denied.

Its access levels still apply, and the SSH certificates it gets open only its boxes.

Rotate a key

Rotate (on a key you made with New key) replaces its secret and shows the new one once; the key keeps its name, access, boxes and expiry. The old secret stops working at once and its tunnels close, so replace it wherever it runs right away; to switch with no gap, make a new key, deploy it, then revoke the old one. Only the member who made a key can rotate it. A machine's key is replaced by running prized login there, and an expired key cannot be rotated.

Revoke (it asks first) retires one key on its next request: a machine's prized stops working until you run prized login again, its tunnel closes, and its SSH key leaves your boxes within seconds; a script gets 401. Revoke all does this for every key, yours included, and cancels install commands nobody has run and unfinished terminal sign-ups; use it for a stolen laptop or a leaked key.

A contractor sees only their own keys. The owner can revoke any key (including one from before workspaces existed), anyone else only their own. Revoking touches no boxes, secrets, or balance; to end someone's access, remove them.

Close or erase the workspace

Close workspace (owner only, under Dashboard → Settings → Data and privacy) pauses every box, cancels the plan immediately, and deletes everything 30 days later unless you reopen; Erase now skips the wait. Details, and what is kept afterwards: Data retention.