# Workspaces > One account for the whole team; boxes, balance, and secrets shared by everyone in it. URL: https://prized.dev/docs/workspaces ## What a workspace is [#what-a-workspace-is] Every sign-in belongs to at least one workspace; a solo account is a workspace of one. Owners and members see the same boxes and spend the same balance (the dashboard's Boxes page lists your own first, with the rest folded under **Team**: [Dashboard: Boxes](https://prized.dev/docs/dashboard#boxes)); a [contractor](https://prized.dev/docs/teams#roles) sees only the boxes they own. Roles, policies, and the rest of what a team gets are on [Teams](https://prized.dev/docs/teams). ## Create one [#create-one] Your first sign-in creates one, named after your company domain or after you. Rename it under **Dashboard → Settings → General**, where the owner can also claim your email domain, with two switches: * **Any user with an @yourdomain email can join without approval.** New sign-ins with a provider-verified address on the domain land in your workspace instead of an empty one. A personal mail domain (Gmail, Outlook, and the like) can never be claimed. * **Restrict membership to only users with an @yourdomain email.** The invite link admits only addresses on the domain. A domain belongs to one workspace: if a colleague claimed it first with joining open, your first sign-in lands you in theirs, and `prized login` prints `✓ signed in as you@yourdomain.com · Acme (shared)`. ## Invite people [#invite-people] **Dashboard → Settings → Members** shows the invite link: anyone who opens it and signs in becomes a member (the owner can then make them a [contractor](https://prized.dev/docs/teams#roles)). **New link** replaces it, and the old one stops working at once. Teammates on a claimed domain with joining open need no link. ## Switch between workspaces [#switch-between-workspaces] Click the workspace name at the top of the sidebar, then **Switch workspace**. Everything there, API keys included, is scoped to the current workspace. ## Remove someone [#remove-someone] **Dashboard → Settings → Members → Remove** (owner only). Their dashboard access ends at once, and every credential they created for this workspace is revoked: API keys (`prized` on their machine and their scripts stop working), unused install links, and any [phone access password](https://prized.dev/docs/codex#from-your-phone). The invite link is replaced, so their copy cannot let them back in; boxes, secrets, and the balance stay. Their boxes, like a leaving member's, stop receiving new [AWS identity tokens](https://prized.dev/docs/aws#on-the-box). The domain never readmits a removed member, even with joining open; only a link shared after the removal does. A member can leave from their own row (the link is not replaced); the owner cannot leave. ## API keys [#api-keys] **Dashboard → Settings → API keys** lists every key in this workspace. An API key (`dcp_…`) acts as the member who made it, with their role, from the CLI or any script ([API](https://prized.dev/docs/api)). A key is shown once; only its hash is stored. Each row shows what the key can do, when it expires, its last use, and its requests over the last 30 days. * **One per machine.** `prized login` makes a key named after the machine; its row shows the CLI version it last reported, and whether it registered an SSH key for [Claude Desktop remote](https://prized.dev/docs/claude-desktop). A machine's key never expires while you use it; after 180 days unused it expires, and `prized` asks you to sign in again. * **One per script or agent.** **New key** asks for a name, what the key may do, when it expires and which boxes it reaches, then shows it once, with a copy button; make one for each script so you can revoke it alone. * **One per agent sign-in.** The key a coding agent got when it made your account with an emailed code ([Agent sign-in](https://prized.dev/docs/agent-sign-in)) is listed by the agent's name and marked as an agent's key: boxes write, workspace read, no secrets or sandboxes, for 90 days. It has Revoke but no Rotate (a new secret would cut the agent off). ### What a key can do [#what-a-key-can-do] **New key** asks for the key's access, and each key's row shows it: * **Full access** (the default, and every key `prized login` makes): everything you can do in the workspace. * **Read only**: it can look at everything you can see and change nothing. * **Custom**: set **Boxes** (boxes, snapshots, environments, shared ports), **Secrets** (secrets and which boxes get them) and **Workspace** (settings, members, team activity, the audit log, billing) each to **None**, **Read**, or **Write** (write includes read). Connecting to a box, and running commands or moving files on one, need Boxes: Write. A key never does more than your role allows; access only narrows it. A key cannot make, rotate or revoke other keys, whatever its access. A call outside its access gets `403 key_access_denied`, with a message naming what the key lacks. To change a key's access, make a new key and revoke the old one. ### When a key expires [#when-a-key-expires] **New key** picks a lifetime: 7, 30 or 90 days (the default), or a year; the workspace owner can also pick **No expiry**. From then on an expired key gets `401 token_expired` on every request, its tunnels end with it, and its SSH key leaves your boxes. A row's light turns amber in the key's last week and red once it has expired; revoke an expired key to clear it from the list. * **Machine keys** from `prized login` expire only after 180 days unused, as above. * **Older keys**, made before keys had lifetimes, never expire and cannot be rotated: replace one with a new key. ### Limit a key to some boxes [#limit-a-key-to-some-boxes] **New key → Boxes → Only some** limits a key to the boxes you tick (up to 50; a contractor ticks only their own). Such a key: * **Can** list, read, wake, pause, resize, move and delete those boxes, connect to them, run commands, move files and prompt agents there, share their ports, and snapshot them. * **Sees nothing else**: any other box answers `404 not_found`, as if it did not exist, and lists leave it out. * **Cannot** reach the whole workspace: creating boxes, forks and templates, secrets, environments, sandboxes, team activity, the audit log and workspace settings answer `403 key_access_denied`. Its access levels still apply, and the SSH certificates it gets open only its boxes. ### Rotate a key [#rotate-a-key] **Rotate** (on a key you made with **New key**) replaces its secret and shows the new one once; the key keeps its name, access, boxes and expiry. The old secret stops working at once and its tunnels close, so replace it wherever it runs right away; to switch with no gap, make a new key, deploy it, then revoke the old one. Only the member who made a key can rotate it. A machine's key is replaced by running `prized login` there, and an expired key cannot be rotated. The old secret cannot obtain a new SSH certificate after rotation. Certificates already issued keep their remaining lifetime. **Revoke** (it asks first) retires one key on its next request: a machine's `prized` stops working until you run `prized login` again, its tunnel closes, and its SSH key leaves your boxes within seconds; a script gets `401`. **Revoke all** does this for every key, yours included, and cancels install commands nobody has run and unfinished [terminal sign-ups](https://prized.dev/docs/terminal-signup); use it for a stolen laptop or a leaked key. A contractor sees only their own keys. The owner can revoke any key (including one from before workspaces existed), anyone else only their own. Revoking touches no boxes, secrets, or balance; to end someone's access, remove them. ## Close or erase the workspace [#close-or-erase-the-workspace] **Close workspace** (owner only, under **Dashboard → Settings → Data and privacy**) pauses every box, cancels the plan immediately, and deletes everything 30 days later unless you reopen; **Erase now** skips the wait. Details, and what is kept afterwards: [Data retention](https://prized.dev/docs/data-retention#closing-a-workspace).