A workspace is the ownership and security boundary for forms, responses, respondents, members, keys, storage, and integrations.
Invite a teammate
Owners and admins can open Settings > Members, enter an email address, choose a role they're allowed to grant, and send an invitation. Only the invited email account can accept it.
You can cancel a pending invitation before it's accepted. Invitations are rate-limited by workspace and recipient to prevent repeated mail. If one expires, send a new one — don't share an acceptance URL with someone else.
Roles
| Capability | Member | Admin | Owner |
|---|---|---|---|
| Work with forms and responses in the workspace | Yes | Yes | Yes |
| Invite members and cancel invitations | No | Yes | Yes |
| Grant member or admin role | No | Yes | Yes |
| Grant owner role | No | No | Yes |
| Remove or re-role a member at or below own rank | No | Yes | Yes |
| Change sensitive workspace configuration | No | Yes | Yes |
| Delete the workspace | No | No | Yes |
An admin can't create, remove, or demote an owner, and no one — not even an owner — can remove the last owner. The server checks the active workspace and membership again on every management action instead of trusting an organization ID from the browser.
Switch workspaces
A user can belong to more than one workspace. The workspace switcher changes the active organization only after verifying membership. Forms, response IDs, provider connections, API keys, and secrets don't cross that boundary.
Use separate workspaces when teams must not share respondent data, storage credentials, or management keys. Separate forms inside one workspace are enough when the same authorized team and integrations own the data.
Code and API access
- A
pk_publishable key syncs code-defined schemas into one workspace and may appear in browser code. - An
fcli_login token carries the current user's management authority while that membership and role remain active. - An
fsk_workspace API key has explicit stored scopes and can outlive a member-role change until it expires or is revoked. - Storage, identity, and webhook secrets stay server-side and workspace-scoped.
The current public Management API doesn't invite members or change roles. Team administration happens in the authenticated dashboard.
Related
- Security and boundaries: Choose the right credential for each environment.
- CLI and publishing: Stage code-defined schema changes with trusted credentials.
- Data retention and deletion: Understand owner-only workspace deletion.