# Workspaces

> One account for the whole team; boxes, balance, and secrets shared by everyone in it.

URL: https://prized.dev/docs/workspaces

## What a workspace is [#what-a-workspace-is]

A workspace is the account your boxes, balance, plan, and secrets belong to. Owners and members see the same boxes and spend the same balance; a contractor sees only the boxes they own. Every sign-in belongs to at least one workspace; a solo account is a workspace of one.

| Role       | In short                                                                                                                        |
| ---------- | ------------------------------------------------------------------------------------------------------------------------------- |
| Owner      | Everything, including billing, the domain, the invite link, roles, policies, and removing members. No policy binds the owner.   |
| Member     | Every box, secret, snapshot and environment; reads the audit log and policies; cannot change billing. Policies bind members.    |
| Contractor | Only the boxes they own and the CLI tokens they created; no audit log, member list, policies, workspace secrets, or connectors. |

The owner switches anyone else between member and contractor from **Dashboard → Workspace → Members**; ownership never changes hands. Roles in full, policies, and everything else a team gets are on [Teams](https://prized.dev/docs/teams).

## Create one [#create-one]

Your first sign-in creates a workspace, named after your company domain or after you; rename it from **Dashboard → Workspace**. Accounts from before workspaces existed became a workspace each; nothing was merged.

With a company address, the owner can claim the email domain on the same page, with two switches:

* **Any user with an @yourdomain email can join without approval.** New sign-ins on that domain land in your workspace instead of getting an empty one. Only a provider-verified address counts; a personal mail provider (Gmail, Outlook, and the like) can never be claimed.
* **Restrict membership to only users with an @yourdomain email.** The invite link admits only addresses on the domain.

A domain belongs to one workspace. If a colleague claimed it first with joining open, your first sign-in lands you in their workspace; `prized login` then prints `✓ signed in as you@yourdomain.com · Acme (shared)`, so a shared workspace never looks like being signed in as someone else.

## Invite people [#invite-people]

**Dashboard → Workspace** shows the invite link. Anyone who opens it and signs in becomes a member; the owner can then make them a [contractor](https://prized.dev/docs/teams#roles). **New link** replaces it, and the old one stops working immediately. Teammates on a claimed domain with joining open need no link.

## Switch between workspaces [#switch-between-workspaces]

Someone in more than one workspace picks the current one from the account menu at the bottom of the sidebar; everything there, CLI tokens included, is scoped to that workspace.

## Remove someone [#remove-someone]

**Dashboard → Workspace → Members → Remove** (owner only). Their dashboard access ends at once, and every credential they created for this workspace is revoked with them: CLI tokens (so `prized` on their machine stops working), unused install links, and any [phone access password](https://prized.dev/docs/codex#from-your-phone) they generated. The invite link is replaced too, so the copy they had cannot let them back in. Boxes, secrets, and the balance stay.

Their boxes also stop receiving new [AWS identity tokens](https://prized.dev/docs/aws#on-the-box), including when a member leaves voluntarily; already-issued tokens and AWS credentials expire separately.

A removed member is not let back in by the domain, even with joining open; only a link shared after the removal re-admits them. A member can leave from their own row (this does not replace the link); the owner cannot leave.

## CLI tokens [#cli-tokens]

**Dashboard → Workspace → CLI tokens** lists every machine signed in to this workspace: its name, when it was last used, the CLI version it last reported, and whether it registered an SSH key for [Claude Desktop remote](https://prized.dev/docs/claude-desktop). The token itself is shown once at sign-in and only its hash is stored.

**Revoke** retires one machine on its next request: `prized` there stops working until you run `prized login` again, its tunnel closes, and its SSH key leaves your boxes within seconds. **Revoke all** does the same for every token at once, including yours: the right move for a stolen laptop or a token pasted somewhere public.

Owners and members see every machine; a contractor sees only the ones signed in under their own account. The owner can revoke any token, a member or contractor only the ones under their own sign-in, and a token from before workspaces existed only the owner. Revoking a token touches no boxes, secrets, or balance and removes nobody; to end someone's access entirely, remove them.

## Close or erase the workspace [#close-or-erase-the-workspace]

**Dashboard → Workspace → Close workspace** (owner only) pauses every box, cancels the plan immediately, revokes every token and key, removes other members, and deletes everything 30 days later unless you reopen from the banner. **Erase now** skips the window. Both, and what is retained afterwards, are on [Data retention](https://prized.dev/docs/data-retention#closing-a-workspace).