# People and invites

> Invite people with a one-time link, change their roles and remove them.

An admin invites people with a one-time link. Each person signs in with a passkey and has one role. For the roles, see [Roles and tokens](/docs/concepts/roles-and-tokens.md).

## Invite a person

1. Make the invite. Only an admin can do this:

   ```sh
   ce people invite ana@example.com --role member
   ```

   The role is `admin`, `member` or `viewer`. You can also invite people on the People screen of the web UI.

2. Copy the link that Checkend prints. It looks like `https://stats.example.com/invite#ceinv_...`.
3. Give the link to the person in a safe channel.

> **Note**
> Checkend sends no email. You give the link to the person yourself.

The link works one time, for 7 days. One email address has at most one pending invite.

> **Caution**
> Keep the invite link private. Anybody with the link can join with the role of the invite.

## Accept an invite

The person opens the link in a browser:

1. The page shows the email address, the role and the end date of the invite.
2. Select **Create a passkey**.
3. The web UI opens with a session.

The page removes the secret from the address bar. A used, revoked or expired link shows the reason. Then ask an admin for a new invite link.

### Without a passkey

Passkeys need HTTPS on a domain name, or `localhost`. On an IP address or plain HTTP, the page offers **Create an API token** in place of a passkey. It shows the token one time.

The person can also accept the invite with `ce`:

```sh
ce invites accept 'https://stats.example.com/invite#ceinv_...'
```

`ce` makes an API token with the scopes of the role, and stores it as `ce login` does.

## Manage invites

```sh
ce invites list           # pending, accepted, expired and revoked invites
ce invites revoke <id>    # stop a pending invite
```

Only an admin can list and revoke invites.

## List people

```sh
ce people list
```

The list shows the email address, the role, the last sign-in and the passkeys of each person. Admins and Members can see the list. A Viewer gets exit code 5.

## Change a role

```sh
ce people role ana@example.com viewer
```

The change takes effect on the next request of the person. Checkend revokes each token of the person that is outside the new role.

Nobody can raise their own role. The last admin stays: make another person admin first.

## Remove a person

```sh
ce people remove ana@example.com --yes
```

Checkend ends the sessions of the person at once, revokes all their API tokens and MCP app tokens, and deletes their passkeys.

## Passkeys

Each person can have more than one passkey. Add a passkey in the web UI, in **Settings**. List and delete your own passkeys with `ce`:

```sh
ce passkeys list
ce passkeys delete <id> --yes
```

## Agents are not people

There are no MCP tools for people and invites. An agent must not invite people, change roles or remove people. Use `ce` or the web UI.