Roles & Permissions

grant your team and customers access

The DevXP engineering team hosts office hours every Thursday at 11 a.m. Pacific Time where we answer your questions live and help you get up and running with Flatfile. Join us!

Administrator Roles

Administrator roles have full access to your accounts, including inviting additional admins and seeing developer keys.

The accessToken provided will remain valid for a duration of 24 hours.

Role	Details
Administrator	This role is meant for any member of your team who requires full access to the Account. ✓ Can add other administrators ✓ Can view secret keys ✓ Can view logs

Guest Roles

Guest roles receive access via a magic link or a shared link depending on the Environment guestAuthentication type. Guests roles can invite other Guests unless you turn off this setting in the Guest Sidebar.

The accessToken provided will remain valid for a duration of 1 hour.

Space Grant

Role	Details
Single-Space Guest	This role is meant for a guest who has access to only one Space. Such guests can be invited to additional Spaces at any time.
Multi-Space Guest	This role is meant for a guest who has access to multiple Spaces. They will see a drop-down next to the Space name that enables them to switch between Spaces.

Workbook Grant

Role	Details
Single-Workbook Guest	This role is meant for a guest who should have access to only one Workbook within a Space.
Multi-Workbook Guest	This role is intended for a guest who has access to multiple Workbooks within a Space.

This role can only be configured using code. See code example.

const createGuest = await api.guests.create({
  environmentId: "us_env_hVXkXs0b",
  email: "[e-mail]",
  name: "Mr. Guest",
  spaces: [
    {
      id: "us_sp_DrdXetPN",
      workbooks: [
        {
          id: "us_wb_qGZbKwDW",
        },
      ],
    },
  ],
});

Guest Lifecycle

When a guest user is deleted, all their space connections are automatically removed to ensure security. This means:

• The guest loses access to all previously connected spaces
• They cannot regain access to these spaces without being explicitly re-invited

This automatic cleanup ensures that deleted guests cannot retain any access to spaces, even if they are later recreated with the same email address.