People and invites

An admin invites people with a one-time link. Each person signs in with a passkey and has one role. For the roles, see Roles and tokens.

Invite a person

1. Make the invite. Only an admin can do this:

   ce people invite ana@example.com --role member

   The role is admin, member or viewer. You can also invite people on the People screen of the web UI.

2. Copy the link that Checkend prints. It looks like https://stats.example.com/invite#ceinv_....

3. Give the link to the person in a safe channel.

Note

Checkend sends no email. You give the link to the person yourself.

The link works one time, for 7 days. One email address has at most one pending invite.

Caution

Keep the invite link private. Anybody with the link can join with the role of the invite.

Accept an invite

The person opens the link in a browser:

1. The page shows the email address, the role and the end date of the invite.
2. Select Create a passkey.
3. The web UI opens with a session.

The page removes the secret from the address bar. A used, revoked or expired link shows the reason. Then ask an admin for a new invite link.

Without a passkey

Passkeys need HTTPS on a domain name, or localhost. On an IP address or plain HTTP, the page offers Create an API token in place of a passkey. It shows the token one time.

The person can also accept the invite with ce:

ce invites accept 'https://stats.example.com/invite#ceinv_...'

ce makes an API token with the scopes of the role, and stores it as ce login does.

Manage invites

ce invites list           # pending, accepted, expired and revoked invites
ce invites revoke <id>    # stop a pending invite

Only an admin can list and revoke invites.

List people

ce people list

The list shows the email address, the role, the last sign-in and the passkeys of each person. Admins and Members can see the list. A Viewer gets exit code 5.

Change a role

ce people role ana@example.com viewer

The change takes effect on the next request of the person. Checkend revokes each token of the person that is outside the new role.

Nobody can raise their own role. The last admin stays: make another person admin first.

Remove a person

ce people remove ana@example.com --yes

Checkend ends the sessions of the person at once, revokes all their API tokens and MCP app tokens, and deletes their passkeys.

Passkeys

Each person can have more than one passkey. Add a passkey in the web UI, in Settings. List and delete your own passkeys with ce:

ce passkeys list
ce passkeys delete <id> --yes

Agents are not people

There are no MCP tools for people and invites. An agent must not invite people, change roles or remove people. Use ce or the web UI.