Who gets access
Every way a person, app, or agent can access Stashbase, and when to use each
Stashbase has a few kinds of identity. Each is scoped differently, so pick the one that matches who or what needs access.
| Identity | Use it for | Scoped to | Manage it in |
|---|---|---|---|
| Member | People on your team using the dashboard | Workspace role, plus project and environment roles | Workspace settings |
| Team | Granting the same access to several members | Project and environment roles shared by all its members | Workspace settings |
| Personal API key | The CLI, scripts, and your own tooling | Your own access, optionally limited to read-only or secrets | API Keys → Personal |
| Service account | CI, servers, and automation across projects | The projects, environments, and permissions you grant it | Workspace settings → service accounts |
| Environment account | An app loading one environment at runtime | A single environment | The environment's Accounts tab |
| Agent profile | Coding agents such as Claude Code and Codex | Per-secret hosts, network, files, and MCP tools | A TOML file in your repo or global config |
Coding agents should never get an API key. Run them with stashbase agent run and an
agent profile, so they get placeholders instead of secret values.
Choosing an identity
- A person gets a member account. Use teams once more than a few people need the same access.
- Your own scripts or the CLI use a personal API key. It can never do more than you can.
- A production app that only needs its secrets uses an environment account. It can't see any other environment.
- CI or automation that works across projects, or manages resources, uses a service account.
- A coding agent uses an agent profile. It never holds the secret itself.
Roles
People and teams get access at three levels. A project role covers all of the project's environments, and workspace admins and owners can access every project.
| Level | Roles | Grants |
|---|---|---|
| Workspace | Member, Admin, Owner | Admins and owners can access every project and manage members |
| Project | Viewer, Editor, Admin | Access to the project and all of its environments |
| Environment | Viewer, Editor, Admin | Access to one environment |
Personal API keys and environment accounts can never have more access than the person who created them.