Skip to main content
Workspaces are collaborative. The Team page manages members, pending invitations, and roles.

​
Roles

Every member has one of three roles:
  • Owner — full control, including workspace settings, billing, member management, and webhooks.
  • Member — day-to-day work: templates, passes, projects, scanning, access tokens.
  • Viewer — read-only: can see passes and scan activity, but no create/manage actions.
CapabilityOwnerMemberViewer
Templates, passes, projects (create/edit/issue/void)✅✅❌
View scans & scan stats✅✅✅
Scanner app setup & devices✅✅❌
Access tokens (create/rotate/revoke)✅✅❌
Webhooks — inspect deliveries✅✅❌
Webhooks — create/edit/delete endpoints✅❌❌
Team — invite, change roles, remove✅❌❌
Workspace settings, billing, security policy✅❌❌
Pages a role can’t use are hidden from the sidebar or show an owners-only notice.

​
Inviting people

Owners click Invite member, enter an email and a role, and Passlet sends the invitation. Pending invitations can be resent or canceled from the Team page; invitees accept via the emailed link. Members can also be invited into other workspaces — everyone can switch workspaces under Settings → Workspaces.

​
Changing and removing members

Owners can change any member’s role or remove a member — removal takes effect immediately and the person loses workspace access.

​
Enterprise SSO

Workspaces with Enterprise SSO configured get a dedicated sign-in path (Continue with Enterprise SSO on the login page, or /login/sso/your-workspace-slug), and new users whose email domain is verified for SSO see a suggestion to join via SSO during onboarding. Contact your Passlet representative to set up SSO for your workspace.

​
Two-factor policy

Owners can require two-factor authentication for the whole workspace under Settings → Policy — members must then enroll an authenticator app before performing sensitive actions. See Account & security.