Workspace, team & roles
Who can do what, how to get your colleagues in, and the settings that live at workspace level. Two independent role systems — one for how much of the business someone can change, one for which stores they work in — so an associate in Leeds sees Leeds, a regional manager sees their region, and neither of them can touch your pricing.
The workspace
Signing up creates a user; naming a workspace creates an organisation and makes you its owner. There is exactly one owner, and it is the account that created the workspace.
Rename it under Settings → Workspace. Renaming is safe — the slug in your tracking tag URL does not change. Names are 2–80 characters, and only the owner or a workspace admin can change them.
Roles and permissions
There are two independent role systems, and both matter. Workspace roles say how much of the business you can change. Channel roles say which stores you work in.
Workspace roles
| Role | Can do | Cannot do |
|---|---|---|
owner |
Everything. Catalogue edits, imports, deletions, payment setup, team, settings. | — |
admin |
Invite and manage people, create and edit any channel, change workspace and tracking settings, tune the ranking engine, feature products. | Anything owner-only: creating or editing products, imports, deleting quotes / orders / customers / webhooks, Stripe Connect. |
member |
Read the team roster. Everything else comes from the per-channel roles they hold. | Workspace settings, team management, catalogue changes. |
Create / update / delete products, product options and variants; generate variants; product and order imports; delete a quote, an order, a customer or a webhook subscription; Stripe Connect onboarding and status. Everything else an admin can also do.
Channel roles
A workspace member reaches real work through channels. Owners and workspace
admins can do anything on any channel regardless of these.
| Channel role | Read the channel | Edit the channel & its QR codes | Manage its staff |
|---|---|---|---|
admin | Yes | Yes | Yes |
manager | Yes | Yes | No |
associate | Yes | No | No |
A shop-floor salesperson is typically workspace member + channel
associate. That is enough to sign in, look up customers, build quotes and
send them — without being able to touch prices or the catalogue.
Inviting people
Team → Invite, or the API. You supply an email, a workspace role, and optionally a channel plus a channel role to grant at the same time.
Three things can happen, and the response tells you which:
status | When | Result |
|---|---|---|
invited |
No account exists for that email. | A pending invitation is stored and an email sent. The response also returns invite_url so you can copy the link if mail delivery isn't set up yet. |
added |
The email already has a Stitchwork account, but isn't in this workspace. | They are joined immediately with the role you chose, and told by email. |
channel_added |
They are already a member and you named a channel. | The channel grant is applied. (Without a channel, this is a 409 — they're already here.) |
Invitations expire, are single-use, and are stored as a hash — the raw token only ever exists in the email. Pending invites can be resent (which mints a fresh token) or revoked. At most one outstanding invite per email per workspace.
Accepting an invite
The invitee opens /invite?token=…. If they already have an account, the
token is enough — possession of it proves control of the mailbox, so their password is
never touched. If they don't, they set a name and password on the accept form.
Either way they end up signed in, with the workspace membership and any channel grant
the invite carried. An expired or already-used token returns
410 Gone.
Managing the roster
Reading the roster is open to any member — colleagues seeing each other is fine. Every write requires owner or admin. You cannot remove yourself.
Channel staff
The per-channel roster lives on the channel detail page, and its API mirrors the team one. Adding someone by email who has no account issues them a workspace invitation carrying the channel grant, so a store manager can staff their own shop without going through the workspace admin first.
MCP seats — letting an AI in
Beyond the roster, a workspace can grant MCP seats: per-person access for an AI client like Claude, or a named headless agent. A seat is a deliberate grant — an owner or admin creates it in Settings → MCP, and it is billed as a per-seat add-on on your terms, so connecting an AI client can never create one or touch the bill on its own.
- A team member's seat inherits their visibility: an associate's AI sees their store, exactly as the app does. Access is read-only throughout.
- Revoking a seat cuts off every token under it on the next request, and removing someone from the team revokes their seat in the same action.
- Someone without a seat who tries to connect is told to ask an admin — nothing is auto-provisioned.
The full picture — tools, connection flow, what the AI can and cannot see — is on the AI agents page.
Your own account
Your name, email and password are yours to change under Settings → Your account. Changing the password signs out nothing else — there is one session per browser — but it does rotate the session id you are currently using.
Forgotten passwords
POST /api/v1/auth/forgot-password always returns the same
200 whether or not the email exists, so the endpoint can't be used to probe
for accounts. Reset tokens are stored hashed, expire in 60 minutes, and are single-use.
Completing a reset signs you straight in.
Sessions
The app authenticates with a plain session cookie: HttpOnly,
SameSite=Lax, 14-day lifetime, and Secure. The session id is
regenerated on sign-in and on password change, so a cookie captured before either one is
worthless afterwards.
If you're calling Stitchwork from your own backend, use the secret tracking key
(sk_live_…) against the external ingest endpoints rather than driving a
session. See Authentication.
Workspace settings reference
Everything on the Settings page, and who is allowed to change it.
| Setting | Where | Who |
|---|---|---|
| Workspace name | Settings → Workspace | Owner / admin |
| Tracking keys | Settings → Web tracking → Generate keys | Owner / admin |
| Join URL | Settings → Web tracking | Owner / admin |
| Consent mode | Settings → Web tracking → Consent | Owner / admin |
| Quote "buy now" URL | Settings → Quotes | Owner / admin |
| Ranking weights | Rankings → Settings | Owner / admin |
| Attribution window | Settings → Attribution | Owner / admin |
| Your Stripe account (quote payments) | Settings → Payments | Owner |