Access and invitations. Choose who can open an app, and invite people to a single app.

Every app has an access mode. A new app starts at org.

hub app my-app access            # show the current mode
hub app my-app access private    # Owner and explicitly invited people
hub app my-app access org        # Organization and explicitly invited people
hub app my-app access public     # Anyone, without a Hub login

private and org require sign-in. Changing modes preserves app invitations. To turn off public access, choose org or private.

Access belongs to an instance, so my-app/staging can be private while my-app is org. hub deploy --public makes a new app public from its first deploy. A change takes effect without a rebuild.

Changing the access mode takes the admin role. Inviting people to an app takes the member role, except into an app with a private instance: only your org's owner invites people there. Listing and revoking invitations take the member role.

Invite someone to one app

hub app my-app invite client@example.com

Hub sends no email. The command prints a link for you to send to the person. They open it, sign in or create an account with that address in the browser, and land on the app. They don't need the CLI. Inviting the same address again prints the same link.

An app invitation lets someone use that app, not manage it or join your organization. The person gets no org of their own, no dashboard for yours, cannot deploy, and cannot see or open your other apps. An invitation covers every instance of the app, and it works in private and org mode alike.

hub app my-app invites                        # who is invited, and who accepted
hub app my-app uninvite client@example.com    # take the invitation back

Revoking an invitation takes effect on that person's next request to the app, because Hub checks their access again. The same goes when you change the access mode, remove someone from your org or change their role. Everyone else with the app open signs in again on that request too, with no form to fill in.

What access does not cover

• private decides who can open the app in a browser. It is not a boundary against members of your org: a member can still deploy to a private app, run commands and open a shell in it, and read its environment variables.
• Making an app private keeps the invitations it already has, including ones members made while it was org. Check hub app my-app invites when you switch.
• Hub does not verify email addresses. Until the person accepts an invitation, whoever holds the link can create an account with that address and claim it. Send links where only that person reads them.
• Invitation links do not expire. If one went to the wrong place, revoke it with hub app my-app uninvite client@example.com. A revoked link stays dead, even if you invite the address again.

Invite someone to your org

An org member can open every org app, and can do in Hub what their role allows. See Teams and roles.

hub invite teammate@company.com

Sign-in

A visitor to a private or org app without a Hub login goes to cloud.myhub.host to sign in, then back to the page they asked for. The login lasts 12 hours per app. Hub checks access before a request reaches your app, so the app needs no login of its own. Who is signed in shows how an app reads the visitor's identity.

A public app gets no identity. Hub removes the identity headers from every request, so a visitor cannot forge them.