Sharing and account access

Everyone signs in with their own Oblien account. You can share an entire account, a namespace, or one workspace. The owner continues to pay for the resources.

Invite someone

Open Sharing in the dashboard sidebar to invite an account member. To share less, open a workspace's Sharing tab or the sharing section of a namespace. Select Invite person, enter their email address, and choose a role. The default role is Viewer. Access can stay open, expire after a set duration, or end at a specific date and time.

Copy the invitation link and send it to your collaborator. Oblien also shows the invitation in their Sharing inbox; it does not send an invitation email. They must sign in with the invited, verified email address and accept. Links expire after seven days. You can cancel a pending invitation at any time.

Use Members to review people and change roles, Pending to manage invitations, and Activity to see recent sharing changes. The action menu beside a person lets you remove their direct access. Inherited access is labeled and must be managed in the account or namespace where it was granted.

Developer and Manager include root access inside the shared workspace. Give these roles to people you trust with its files, processes and secrets. A Viewer cannot open its terminal, files or desktop.

Billing, payment methods, API key management, personal security settings and platform administration remain outside these collaboration roles. The Owner role cannot be assigned through an invitation.

Open shared workspaces

Open Workspaces and change the This account filter to Shared with me. Shared workspaces use the same list, search and grid views, with their owner and your role shown beside each workspace. Open one directly while staying in your personal account; you do not need to switch accounts.

For an accepted account invitation, click the arrow beside your account at the bottom of the sidebar and choose an account from the menu to manage its workspaces and namespaces. The selected account name stays visible. Use the same menu to switch back to your personal account. Selection is local to the browser tab, so different tabs can manage different accounts.

Your login and security settings always belong to you. Workspace actions are recorded under the person who performed them, and usage belongs to the resource owner.

Terminal, runtime API, SSH and desktop

Open the usual workspace tabs. Controls are shown according to your role, and the API checks the permission again for every operation.

Shared runtime connections use a short-lived, personal connection token. In the SSH tab, select Get SSH connection to get a native SSH/SFTP command and connection password. For the owner, Enable SSH handles first setup in one step. Collaborators connect after the owner enables SSH. Verify the displayed gateway fingerprint when connecting for the first time.

After a workspace has been shared, use its authenticated SSH connection instead of the old anonymous jump command. This prevents a removed collaborator from reconnecting through the gateway with a guest password they previously knew.

Desktop access must be enabled by an operator before connecting. The browser viewer and the VNC-over-SSH instructions use the same individual access checks. Desktop-only connection credentials cannot open an SSH shell.

Connections and sharing tokens expire within one hour. Generate a fresh one when needed. Keep tokens and connection passwords private.

Change or remove access

An Owner or Manager can change a role, remove a member, or cancel an invitation from the same Sharing panel. A person can leave an account they were invited to. Recent access changes appear in that panel; direct workspace sharing events also appear in the workspace's Audit tab.

Removal blocks new authorized requests immediately. Active managed streams and connections are checked every five seconds and closed when access is gone. Removing a grant does not remove access separately granted through an account or namespace. Tokens issued from the removed grant remain invalid even if the person is invited again.

Removing access does not undo completed commands, stop a workload already started, erase a file someone downloaded, or revoke credentials for an external service. Review public services and guest secrets when removing a trusted operator.

Use the SDK

The sharing methods use a personal login session. Existing API keys remain tied to their issuing account. For automation with delegated access, issue a scoped token; it cannot exceed its issuer's current permissions.

import Oblien from 'oblien';

const me = new Oblien({ token: personalSessionToken });
const { workspaces } = await me.access.sharedWorkspaces();

// Open a shared workspace without changing account context.
const workspace = me.workspace(workspaces[0].id);
const runtime = await workspace.runtime();
await runtime.exec.run(['uname', '-a']);

// Independent clients keep concurrent requests in the correct account.
const team = me.withAccount(accountId);
const { workspaces: teamWorkspaces } = await team.workspaces.list();

const scoped = await me.access.issueToken({
  account_id: accountId,
  resource_type: 'workspace',
  resource_id: workspaceId,
  role: 'developer',
  ttl: 900,
});
const automation = new Oblien({ token: scoped.token });
await automation.workspace(workspaceId).start();

A scoped collaboration token is bound to the issuer's login, current grants and chosen workspace or namespace. Logging out, expiry or a change to the grants used to issue it invalidates the token. To issue another, sign in again or use an active login. It cannot invite people or manage billing.

The API uses /access/accounts, /access/shared-workspaces, /access/invitations, /access/members, /access/tokens and /access/audit. Account context is carried in X-Oblien-Account; a header by itself never grants access. Workspace IDs are the stable way to open shared resources across accounts.