Share an app with your team

You can limit an app to a specific team and share its URL. This guide gives access to the sales team and the people who manage the app.

Inviting members and creating groups requires the Owner or Admin role. Changing app permissions requires manage permission for that app. These features are available on all plans.

These settings determine who can open the app. Business rules such as “users can see only their own requests” or “only a supervisor can approve requests” must be implemented inside the app.

1. Invite members

Open Members and choose the invite action. Enter the sales team’s email addresses and select App User. This role is for people who only use apps and does not consume Developers seats, the allowance for people who build and manage apps.

Each recipient opens the email link, signs in with the invited email address, and accepts the invitation. See Invite Members for details. You do not need to invite someone who has already joined.

If a recipient has a valid invitation, signing in with the invited address and opening an app may also accept it automatically. Before adding someone to a group, check the Members page to confirm they have joined the workspace.

For larger organizations, domain-based joining lets employees join without individual invitations on Team plans and above.

2. Create a group

A group is a set of members you can assign app permissions to together. Open Members → Groups, create a group named Sales, and add the sales team members.

Each group has a display name and a key used in settings and commands. This example uses sales as the key. You cannot change the key after creation, but you can change the display name and membership.

3. Choose which groups can use the app

Open the app’s Permissions tab. View permission lets someone open and use the app. Manage permission lets someone deploy the app and change its settings. Manage permission also includes viewing the app.

New apps grant view permission to everyone (all members) and manage permission to developers (Owners, Admins, and Developers). Adding Sales to the view groups alone leaves everyone in place, so everyone can still open the app.

Select Edit under View Permission.
Clear Everyone (everyone) and select Sales (sales).
Select Save under View Permission.

In this example, leave manage permission assigned to developers. View and manage permissions are saved separately, so save changes to view permission in the view section.

The sales team and members of developers can now open the app. App Users outside Sales cannot. If this app’s permissions were changed before, check for any other view or manage groups that remain assigned.

To change who can manage the app as well, see Groups and App Permissions. Anyone with manage permission can open the app even if they do not belong to a view group.

Access checks may take time to reflect saved changes. Once applied, the updated permissions also apply to users who are already signed in.

Copy the URL from the app page (for example, https://acme--sales-tool.keelson.run) and share it in chat or email. App Users cannot look up app URLs in the console, and invitation emails do not include app URLs.

Include a note such as “Sign in with the email address you were invited with” to help people who use several accounts.

5. Test with people who should and should not have access

Check that intended users can open the app and that someone with neither view nor manage permission cannot.

Check	Expected result
A Sales group member opens the URL	The app appears after login
An app manager outside the Sales group opens the URL	The app appears after login
An App User outside Sales, with no view or manage permission through another group, opens the URL	An access denied page appears after login
Someone who is not signed in opens the URL	Keelson’s login page appears; the app is not shown

If no one outside the intended audience is available to test, invite another email address of your own as an App User and test without adding it to Sales.

You can check the saved settings in the app list’s Access column. When view access is restricted, it shows a member count; hover over the count to see the group names. Use the checks above to verify actual access.

Troubleshooting

Problem	What to check
A sales team member cannot open the app	Confirm they have joined the workspace, belong to `sales`, and are signed in with their registered email address
Someone outside Sales can open the app	Check whether `everyone` or another view group is still assigned, or whether the person belongs to a manage group
Saved settings do not change access	Changes may take time. Wait briefly, reload, and check the saved Permissions settings and the account used for testing

For other checks, including disabled members and IP restrictions, see Troubleshooting access.

Ask an AI agent to configure access

An AI agent that can use the CLI can create groups and configure app permissions. Give it the workspace, app name, email addresses of the people to include, and who should retain manage access. The same permissions are required as when using the console.

Configure sales-tool for the sales team and app managers. Add [email protected] and [email protected], who have already joined the workspace, to the Sales group (key: sales). Set view access to sales and manage access to developers. Afterward, tell me which groups have view and manage access.

After the agent finishes, test access with the accounts described in step 5.

CLI example

Create a group and add members who have already joined the workspace. These commands make the same changes as steps 2 and 3 in the console. You do not need to run them if you have already configured access in the console.

keelson groups create sales --name "Sales"
keelson groups members add sales [email protected] [email protected]
keelson access set --app sales-tool --view sales --manage developers

Pass the view and manage groups you want to keep to access set. This example sets view access to sales and manage access to developers.

Show users only their own data

The settings above determine who can open the app. To show each person only their own requests, you can ask your AI agent:

Use the signed-in user’s identity provided by Keelson to show only their own requests. Prevent them from retrieving or updating someone else’s request, even if they supply its URL or ID, and verify that this protection works.

Alongside filtering the interface, your server-side code must check permissions when retrieving or updating data. Ask the agent to report how it verified that users cannot retrieve or change another person’s data.

Use the user ID supplied by Keelson (X-Keelson-User-Id) or group information for these checks. Do not identify a user solely from values sent by the browser. See Use the Signed-in User’s Identity for implementation details.

Workspace, app, and business permissions

Permission	Who configures it and where	Examples
Workspace management (roles)	Assigned by an Owner or Admin. Only Owners can assign or change the Owner role	Inviting members or handling billing
App view and manage permissions (`view` / `manage`)	Assigned to groups by someone with manage permission for that app	Opening the app, deploying it, or changing settings
Business permissions inside the app	Implemented by the app	Viewing only your own requests or approving requests as a supervisor

App manage permission is for people who deploy the app and change its settings. They are not necessarily the people who approve business requests. See Members and Roles for role details.

Groups and App Permissions — permissions and CLI commands
Invite Members
IP Restrictions — also restrict access by network
App URLs and Domains