# Invite users to a workspace

Invite teammates from the Workspaces page, choose their role, and understand what happens when they accept.

Invitations add another account to a workspace. Use them when a teammate needs access to the workspace's metrics, dashboards, alarms, notification channels, roles, or tokens.

Each invitation assigns one role. After the recipient accepts, that role controls what they can do inside the workspace.

## Who can invite users

Only the workspace owner can send invitations.

Inviting users is an account-specific owner action. It is not a workspace role permission, and it cannot be delegated to an API token or a custom role.

## Choose the workspace first

Open **Workspaces** from the main menu.

If your account has access to multiple workspaces, make sure the workspace you want to share is selected as the current workspace. The invite form appears on the current workspace card when you are the owner.

Each workspace card shows whether you are the **Owner** or a **Member**. Members can use the workspace according to their role, but they cannot invite other users.

## Send an invitation

On the current workspace card:

1. Find **Invite member**.
2. Enter the person's email address.
3. Choose the role they should receive.
4. Select **Send invite**.

The role dropdown shows the built-in roles and custom roles available in the workspace. Internal roles are hidden.

Start with `ReadOnly` when the person only needs to view dashboards and metrics. Use `Admin` only for trusted teammates who need broad workspace control. Create a custom role first when the person needs narrower access.

See [Create and use roles](/docs/roles) for default roles and custom role policies.

## Accept an invitation

The recipient receives an invitation link by email.

When they open the link, the app shows:

- workspace name and ID;
- assigned role;
- invited email address;
- expiration time.

If the recipient is signed in, they can select **Accept invitation**. If they are not signed in, they can sign in or create an account from the invitation page. The invite token is carried through the sign-in or sign-up flow.

After acceptance, the workspace appears on their **Workspaces** page. They can switch to it like any other workspace available to their account.

## Change a member role

After an invitation is accepted, the person appears in **Members** on the current workspace card.

To change their role, choose a new role from the member row and select **Save**. The API instance that handles the change uses the new role immediately. In a multi-replica deployment, another API instance may use the previous role for up to about 30 seconds while its authorization cache expires.

Only the workspace owner can change accepted member roles.

## Remove a member

To remove an accepted member, select **Remove** on their row in **Members** on the current workspace card. The member loses access to the workspace and no longer sees it on their **Workspaces** page.

Only the workspace owner can remove members. Removing a member is an owner-only account action; it is not a workspace role permission and cannot be delegated to an API token or a custom role. You cannot remove the workspace owner.

A removed member can no longer select the workspace. Existing workspace sessions are also denied after membership caches refresh; they do not retain access for the full session-token lifetime. The API instance that handles the removal invalidates its cache immediately, while another API replica may continue accepting the previous membership for up to about 30 seconds.

## Expired or invalid invitations

If an invitation is expired or invalid, the invitation page shows an error and the recipient cannot accept it.

Send a new invitation from the **Workspaces** page when the original link can no longer be used.

## What invited users can do

Invited users are workspace members. Their role determines which workspace resources they can read, list, create, update, or delete.

Roles apply to workspace resources such as metrics, dashboards, alarms, notification channels, roles, and tokens. Roles do not grant account-specific actions such as changing account settings, selecting another user's workspace, accepting invitations for someone else, or sending workspace invitations.

For automation, use an API token instead of a user invitation. Tokens also require a role, but they are scoped to the current workspace and are meant for scripts, jobs, and services.

See [Create an API token](/docs/tokens) for token setup.