Core concepts

Teams & roles

Bring teammates into a company, control what they can do with roles, and grant decryption access by sharing wrapped project keys.

Roles

RoleCapabilities

adminManage members, invites, billing, and view audit logs. Full project access.

memberPush and pull on projects whose key has been shared with them.

readonlyPull and decrypt, intended for consumers like CI that should not write.

Inviting people

An invite creates a code (prefixed INV-) tied to the company, an email, and a role, valid for 14 days. When the invitee already has a published public key, invite can wrap and share the current project key in the same step so they can pull immediately on joining.

terminal

# invite + share the current project key when possible$ packshell invite teammate@company.com --role member

You can also generate invites from the dashboard Team page and copy the code to share.

Joining a company

The invited teammate authenticates, then redeems the code:

terminal

$ packshell auth$ packshell join INV-7K2M9XQ4P1ABC

Sharing project access later

To grant an existing member access to a project's secrets after the fact, share the project key with them. The key is wrapped to their public key locally before upload.

terminal

$ packshell share teammate@company.com --role member

Access is per projectMembership in a company is separate from holding a given project's key. Someone can be a member without being able to decrypt a project until its key is shared with them.

Accountability

Admins on the Team plan and above get an audit log of member joins, invites, pushes, pulls, key shares, and plan changes — visible in the dashboard Activity console. See plans & limitsfor which plans include audit logging.