Workspaces and members

One account per person

• Each person has one account with a public @handle, chosen at sign-up. The handle identifies, finds and invites a person; it is never used to sign in.
• A person can have several verified e-mails and sign in with any of them. The sign-in e-mail carries an 8-digit code and a single-use magic link.
• People and organizations share the same handle namespace. A changed handle stays reserved for its previous owner for 30 days, and words such as all, owners and admins are not allowed.

Workspaces

A workspace groups services, tokens, rules, hooks, history and members.

• Every person has a personal workspace with the same handle.
• An organization is a workspace with its own name and handle. Whoever creates it becomes the owner.
• A person can belong to many workspaces and switch between them in the app.

Role	Can
owner	Everything, including members, invites and the workspace handle.
admin	Manage services, tokens, rules, hooks, webhooks and invites.
member	Receive notifications, answer decisions and read the workspace.
guest	Limited access, for people from outside the organization.

Each membership stores which of the person’s e-mails represents that organization. That is the e-mail members see, the one the audit trail records, and one that services can use in to.

Invites

• Invite by e-mail or @handle, with a role (admin, member or guest). An invite is valid for 7 days and can be resent or cancelled.
• When accepting, the person chooses which of their e-mails represents them in the organization.
• Nobody is notified without consent: to only resolves people who accepted. Removing a member cuts access immediately.

Invite privacy

Like a messaging app with a username and PIN, each person chooses who can invite them by @handle in Account → Privacy:

Policy	Effect
anyone	Any organization can invite the handle.
pin	The organization must type the person’s PIN (4 to 8 digits). Wrong PIN: the invite is refused; 5 wrong attempts per hour are blocked.
nobody	Invites by handle are refused.

• An invite to one of the person’s e-mails always works (whoever has the e-mail already has contact), except from a blocked organization.
• A person can block an organization: its pending invites are declined and future ones are hidden, without telling the organization. A blocked organization and the nobody policy return the same error, so the block is never revealed.

Note

Inviting people, changing roles and removing members always require a person signed in. Service tokens, including AI agents, receive 403 user_session_required on those routes.

Services and tokens

A service is a system that talks to notific.me (Dokploy, a CRM, an AI agent). Each service has a slug (the source of its events) and one or more tokens (nm_svc_…), shown only once, with scopes:

Scope	Allows
events:write	Send events and live cards, post to hooks.
asks:write	Create question sets (POST /v0/asks).
asks:read	Read and wait for answers (GET /v0/asks/{id}).

More scopes (workspace:read, rules:write, tokens:write and others) let a token manage the workspace, which is how AI agents administer it over MCP. See AI agents and MCP. Disabling a service blocks all its tokens immediately; revoking a token blocks only that one.