Docs / Team and security

Teams and members

Create a team, invite members by email, link or company domain, and use roles to control who can do what.

A team (also called a workspace in the app) holds everything in Pangea: connected runtimes, infrastructure accounts, agents, plans and memory. You get a team the first time you sign in at app.pangea.build, and you grow it by inviting colleagues.

Roles

Every team has one Owner. Every other member has one of three roles:

Admins and Members can change the workspace name and icon. Only Admins can change roles or remove people. You can't change your own role, and a team always keeps at least one Admin.

Invite by email

1. Open Settings → Members and click Invite.
2. Enter the email address and choose a Role: Admin, Member or Viewer. The default is Member.
3. Click Invite.

Pending invitations stay in the members table until someone accepts them. An email invitation expires after 7 days. An Admin can cancel it at any time with Cancel invite.

Invite links

An invite link lets anyone who has it join while the link has uses and days left. Admins create links in Settings → Members → Invite links → New link.

Pangea shows the link only once, right after you create it. Copy it and share it then. A team can have up to 20 active links.

Click Revoke to stop a link. No one else can join with it, but people who already joined stay. Each link shows its state: Active, Expired, Used up or Revoked.

Company domains

An Admin can claim the company's email domain, so colleagues can join without an invitation.

1. Open Settings → Members → Company domains and click Add domain.
2. Choose the role new people get under Joins as: Member or Viewer. Never Admin.
3. Add the TXT record that Pangea shows at your DNS provider. The record is named _pangea-verify.<your-domain> and its value starts with pangea-verify=.
4. Click Check DNS. DNS changes can take a few minutes to show up.

Once the domain is verified, anyone who signs in with an email on that domain can join the team. A verified domain belongs to one team only.

Allowed email domains

Settings → General → Allowed email domains is a lighter option. Click Enable domain discovery to let teammates on your own email domain find and join the workspace. Pangea always uses the domain of your account email, and public email providers are not allowed. People who join this way get the Member role, unless the domain is verified under Company domains with another role.

Two-factor authentication

Each person can turn on two-factor authentication in Settings → Account → Two-factor authentication. It uses an authenticator app, and you get recovery codes when you turn it on. Each recovery code signs you in once. Pangea shows them only once, so save them.

• Turn on needs a sign-in from the last 10 minutes. If yours is older, sign out and sign in again.
• Turn off and Replace codes need a current code from your authenticator.
• With two-factor on, every sign-in asks for a code after your email, password or Google account.

Pangea also uses step-up checks. With two-factor on, a sensitive action can ask for a fresh code if you haven't entered one in the last 10 minutes. The app asks for the code and then finishes the action.

Review where you are signed in under Settings → Account → Signed-in devices.

Your team ID

Each team has an ID, shown in Settings → General → Team ID, with a Copy team ID button. You may need it when you set up cloud trust. See Connect AWS and IAM trust model.

Leaving or deleting a workspace

Settings → General has Leave workspace and Delete workspace. Any member can leave, except the owner and the last Admin. Only the owner can delete the workspace.

Membership, conversations and computers

Team membership does not give access to every private conversation. Each conversation has its own sharing settings and participants. A shared computer also has its own access list, so someone invited to a conversation may still need permission to use its computer. See Agents and shared sessions.

Team skills, instructions and memories are shared knowledge. Personal credentials and personal settings are separate. Check the scope before you save information or share a computer that has CLI sign-ins on it.

Where settings live

Team connectors live under Connectors in the sidebar, not in Settings. See Connectors.