Appearance
Workspaces & teams
A workspace is where your projects, team, secrets, and saved components live. This page covers roles and what each can do, inviting people, the audit log, and switching between workspaces.
What a workspace is
The workspace is FlowRunner's unit of ownership. Everything you build belongs to exactly one workspace, and everyone who can see that work is a member of it.
When you sign up, FlowRunner creates a personal workspace for you automatically — a private space that is yours alone. You can keep working there, or create additional workspaces to collaborate with a team. A workspace becomes a team the moment you invite someone into it.
Roles
Every member has one role in a workspace. Roles are ranked, and each higher role can do everything the roles below it can, plus more.
| Role | Can do |
|---|---|
| Viewer | Read projects and view run history. No editing. |
| Editor | Everything a viewer can, plus create and edit projects, build flows and pages, manage custom domains, and publish. |
| Admin | Everything an editor can, plus manage members (invite, change roles, remove), manage the secrets vault, rename the workspace, and read the audit log. |
| Owner | Everything an admin can, plus delete the workspace and transfer ownership. |
The ranking is owner > admin > editor > viewer. Access checks are "at least" checks — a route that requires editor also admits admins and owners.
NOTE
A workspace must always keep at least one owner. FlowRunner blocks the action if you try to demote or remove the last remaining owner — promote someone else to owner first.
Inviting people
Admins and owners can invite new members. You invite by email address and pick the role the new member will get — admin, editor, or viewer. (Owner is not an invitable role; you promote an existing member to owner instead.)
Each invite produces a unique link that stays valid for seven days. FlowRunner tries to email that link to the address you entered, and it always shows you the link as well, so you can share it directly if email is not set up in your deployment.
TIP
Email delivery uses Resend and needs RESEND_API_KEY configured. If it is not, invites still work — just copy the link FlowRunner shows you and send it yourself. See Troubleshooting.
Leaving a workspace
Any member can remove themselves from a workspace — this is the "leave" action. The last owner cannot leave, for the same reason they cannot be removed: the workspace would be left without an owner.
The audit log
Admins can read the workspace audit log — a newest-first trail of security and administrative events. It records things like a member's role being changed, a member being removed or leaving, a secret being set, and the workspace being deleted. Each entry names the actor (resolved to their email), the action, and when it happened.
The audit log is your answer to "who changed this, and when." It is append-only and best-effort by design: an audit write never blocks or fails the action it is recording.
Switching workspaces
If you belong to more than one workspace, FlowRunner tracks which one you are currently working in with a current-workspace setting stored in a cookie. The workspace switcher in the header changes it, and your dashboard then scopes to that workspace — you see only its projects, members, and secrets.
Switching is how you move between, say, your personal workspace and a shared team workspace without signing out.