Share an app with your team

This guide walks through invitations and verification using an app that only the sales team can use.

• What you can do: Make an app available only to a specific group in your workspace
• Required permissions / plan: Owner or Admin to invite members and create groups. Anyone with manage on the app can change its permissions. Available on all plans
• Done when: A sales user can open the app, and a user outside sales sees “Access denied”

Three layers of permissions

First, distinguish these three decisions, which are easy to confuse.

Decision	Who controls it	Example
Workspace administration permissions (roles)	Owner / Admin assigns roles	Whether someone can invite members or view billing
App access and management permissions (groups × view / manage)	Someone with manage on the app assigns permissions	Whether someone can open the app, deploy it, or change its settings
Business permissions within the app	The app’s code	Whether someone can see only their own requests or approve requests as a manager

This page covers the second layer. For the first, see Members and roles. For the third, see Use identity in your app.

manage gives an operator permission to deploy and configure the app. That person is not necessarily a business approver. A rule such as “only managers can approve” belongs to the third layer and is enforced by the app.

1. Invite members

Go to “Members” → “Invite,” enter the sales team’s email addresses, and select the App User role (for people who only use apps; it does not consume a Developers seat).

Recipients open the email link, log in with the account matching the invited email address, and accept the invitation. See Invite members for details.

For larger organizations, domain auto-join on Team plans and above lets employees join without an invitation.

2. Create a group

Go to “Members” → “Groups,” create a “Sales” group, and add its members. The key (such as sales) cannot be changed after creation, so choose a stable name such as a department code.

keelson groups create sales --name "Sales"
keelson groups members add sales tanaka@example.com suzuki@example.com

3. Restrict app access to sales

Open the app’s “Permissions” tab. This is the key step.

New apps default to view access for everyone (all members) and manage access for developers. Adding view access for “Sales” alone still lets everyone open the app, because everyone retains view access.

1. Remove everyone from the view groups
2. Add sales to the view groups
3. Keep developers as the manage group (someone needs to update the app)

keelson access set --app sales-tool --view sales --manage developers

Members of the manage group (developers = Owner / Admin / Developer) can open the app even if they are not in a view group, because manage includes view access. You cannot hide the app from its developers. Since they can deploy it, assume they can also see its contents.

Changes take effect when saved and usually apply to users who are already logged in within two minutes.

4. Share the URL

App Users cannot open the console, so they cannot look up the app URL themselves. Copy the URL from the app page (https://<workspace>--<app>.keelson.run) and send it by chat or email. Invitation emails do not include the app URL.

5. Verify both outcomes

Check both that authorized users can open the app and that other users cannot.

Check	Expected result
A user in the sales group opens the URL	The app appears after login
An App User outside sales opens the URL	An “Access denied” screen appears after login
Someone who is not logged in opens the URL	The Keelson login screen appears; the app is not displayed

If no one is available to test denied access, invite another account of your own (with a different email address) as an App User, leave it out of the sales group, and test with it.

If “Access scope” in the app list shows a member count and groups instead of “Everyone,” the settings have been applied.

Troubleshooting

Symptom	What to check
A sales user cannot open the app	Have they joined the workspace (accepted their invitation)? Are they in sales? Are they logged in with the invited email address? Are IP restrictions blocking them?
Users outside sales can also open it	Is everyone still in the view groups? Is the user in developers (Owner / Admin / Developer)?
A settings change has not taken effect	Changes usually apply within two minutes. Reload the browser

See Troubleshooting access for additional checks.

Limit users to their own data inside the app

The steps above restrict app access to sales. Rules such as “show only my requests” or “only managers can approve” belong to the third layer. The app enforces them by reading X-Keelson-User-Id and group information.

Changing what the screen displays is not enough. Filter lists to the user’s own records, and verify on the server that users cannot retrieve or update someone else’s request by passing its ID to the API. Base these decisions on headers added by Keelson, rather than values sent by the browser. See Use identity in your app for implementation guidance.

Related pages

• Groups and app permissions — permissions and CLI commands
• Invite members
• IP restrictions — restrict access by network as well
• App URLs and domains