Workspaces and access

Workspaces own resources

Open All workspaces next to the current workspace on the projects page, or open Workspaces in the account menu. Choose Open projects for a workspace, or Manage access if you are its owner. Create a workspace or accept an invitation below the list. Project, service, environment, log, variable, artifact, and service-backup access is checked against current membership. A selected workspace is navigation, not proof of permission. Tabs targeting different projects do not change each other's authority.

The platform operator can create a workspace. An owner manages members and workspace connections. A member is a trusted developer who can create projects and services, deploy, read logs and application variables, and inspect backups. Owners additionally manage destructive actions, restoration, invitations, and CI tokens. Deployment gives effective access to application secrets through the deployed code.

Workspace ownership does not grant platform-operator permissions. Host administration, shared Cloudflare/R2 credentials, the GitHub App signing key, and the full platform backup remain operator-only. Projects cannot currently be transferred between workspaces.

Invite a trusted teammate

In Workspaces → Manage access, enter the person's stable numeric GitHub user ID and choose Member or Owner. Share the generated link yourself. Upferry does not automatically email it. The invitation expires after seven days, can be used once, and is bound to that GitHub account. Sign in with GitHub, reopen the invitation link if needed, and accept it in Workspaces.

Owners can change roles or remove members from the same page. The last owner cannot be removed or demoted. A new workspace has no notification recipients. Configure its email or Telegram connection on its access page. Operator notification settings are separate. Saving a workspace notification connection does not send a test message; verify the sender domain in Resend first.

Sessions and CI tokens

Open Sessions and devices in the account menu to review current browser and CLI sessions. The page shows sign-in and expiry times, with the current browser identified separately. One device can have several sessions. Choose for an individual session, or confirm to end every browser and CLI session, including your own. Sign in again with GitHub to restore access. This does not sign you out of GitHub or stop running applications. CI tokens are managed and revoked separately in the workspace's access page. Tokens are shown once, expire within 90 days, and target one project and environment. The UI grants deployment and optional log access. Store the token as a CI secret in .