Team access and roles

On a team, each member works in their own projects and devboxes; what you share is the starting environment and the settings around it. Admins manage the shared pieces, and every member connects their own agent accounts and supplies their own credentials.

Members and admins

Every member can browse the team's available Team Templates and create a project from one that has a saved version. Team admins also prepare and manage those templates — creating, editing, renaming, archiving, and restoring them, and managing their saved versions — and handle membership, workspace integrations, billing, and team network settings.

If you're an admin, open your account menu at the bottom of the desktop sidebar and choose Manage team to open Team Settings. Invite new members there; if an email address is already on the team, manage that person under Members instead, where you can change a teammate's role between Admin and Member. Your own role is read-only — another admin needs to change it.

Template administration and template use live in different places. Admins open Team Templates in the desktop project selector to create and manage templates; members don't see that menu. To start a project from a template, anyone uses New project... → Start from a Team Template.

For Slack and Linear, a team admin needs to connect the workspace before members can link their own accounts. Admins also manage paid seats and payment settings; see Manage billing and usage.

Invite a teammate by email and choose their team role. Select the image to enlarge it.

Remove a member

In Members, open another member's menu and choose Remove from team…. Select a remaining teammate to receive their work, then choose an action for each project:

• Transfer will move the project and its work to the selected teammate. boxes.dev will retain a record of the original account for transferred work.
• Delete will permanently delete the project, its devboxes, and its data. Confirm each project selected for deletion.
• Keep will move the project to the departing member's new personal team. Managed files, managed secrets, and team access will be removed. Ordinary files and unmanaged portions of environment files will remain. A Member project will receive an independent Template box.

Running work will stop during the move, and automations will pause. The new owner will need to review connections before resuming automated work. Kept projects will lose existing thread-sharing access. The removed account can continue using boxes.dev on its personal team. The personal team will need its own billing setup before starting compute; the former team's payment method and credits will stay with that team.

Before removing a member, remove any paid seat in Billing, finish pending project operations, and save or discard their Team Template editing sessions. You cannot remove yourself. You can close the removal dialog and return to Team Settings to check progress or retry an interrupted removal. If the member has Team Template conversations, select another admin to receive that work.

Choose how to share an environment

A Team Template is a shared starting environment: repositories, installed tools, and project defaults that members receive in a new project. As an admin, decide how members should receive later updates before inviting them to use it:

Saving a new Team Template version will not replace files on existing devboxes in either mode. Changes to managed environment values and member files have separate rules.

Templates create independent projects by default. To switch one to Member projects, open its Member projects card and choose Set up managed projects…. This cannot be undone: members will permanently lose the option to create independent projects from that template. Enabling it needs a current saved version whose repositories use standard github.com remotes, local repository paths, or no remote. Other network origins are supported only for independent projects; adding one after enabling Member projects will block saving a new version.

For a template with Member projects enabled, Pause new projects will stop members from creating new projects while existing projects created from it keep working and creating devboxes; Resume new projects makes creation available again. Pausing is not the same as archiving, which also hides the template from members and prevents new editing sessions; see rename, archive, or restore a template.

Choose whether a template allows independent projects as well as member projects. Select the image to enlarge it.

Keep personal access separate

Each member supplies their own required files and environment values, and boxes.dev delivers them only to that member's exact project. Admins can see whether Member-project preparation needs attention, but cannot read a member's credentials or personal script output through Team Template management.

Saved versions exclude the admin's boxes.dev-managed agent logins and private agent sessions. Credentials an admin installs manually can still be copied to members, so before saving a template, review the files on its editing machine and remove anything teammates should not receive.

Share work with teammates

Use thread sharing to let a teammate read a conversation. A thread's permanent URL identifies it; the URL alone does not grant access, and team membership does not make every private conversation public. When team access is enabled, Teammates' projects in the project selector opens another member's project in a read-only Team workbench.

Connect to services that require a fixed IP

If an external database or service accepts connections only from approved IP addresses, request a static egress IP for your team. It is a stable public IPv4 address for connections to destinations you configure.

You need a team admin to configure the destinations. If you're an admin:

1. Open Team Settings → Static egress IP and choose Talk to us to request enablement. The feature is off by default.
2. Once it is enabled, add the service's exact public hostname or IPv4 address and TCP port, such as db.example.com on port 5432.
3. Allowlist the displayed static IP at the external service, then test the connection from a devbox.

Every member can copy the IP and view the destinations; only admins can add or remove them. Wildcards, private or reserved addresses, address or port ranges, IPv6, and UDP are unsupported.

Settings changes will reach running devboxes automatically. Sleeping devboxes will reconnect after waking, using the same saved IP and destinations.

If the static-IP connection becomes unavailable, access to the configured destinations will stop rather than switch to a different public IP; other network traffic can continue. During a temporary refresh problem, an existing connection may keep working until its authorization expires — within ten minutes, or sooner if its DNS record expires. Suspension, a gateway restart, or a network setup failure can interrupt access immediately.