Sharing services and connections with teammates

Your cloud services (databases, caches, queues, buckets and email) and your connections (cloud accounts, Git accounts and package repositories) can be shared with teammates one by one, the same way as servers. A new member starts with none of them. You decide, for each person, which ones they see and how far they can go.

This page covers services and connections only. For inviting people, roles and project access, see working with your team.

When to use it

• A teammate should create projects, but only in your staging cloud account, not production.
• A developer needs to attach the shared staging database to their project, but shouldn't see its password.
• A contractor should browse one Git account's repositories and nothing else.

Levels for a service

Each level includes the ones before it:

• See: the service's engine, status, size and cost. The password stays hidden.
• Use: also attach it to, or detach it from, a project they can change.
• Manage: also resize it, set up its email addresses, and analyse how a project would use it.

Can reveal passwords is a separate tick. It shows the full connection string and password, and every reveal is recorded with the person's name. It includes seeing the service, but not using or managing it.

Even without a grant, a member always sees a service that is attached to a project they can open, inside that project.

Levels for a connection

• See: that the connection exists, its name and status. Never a credential.
• Use: also choose it for new projects, environments, services, scans and builds.

Think before giving Use. In a cloud account, it means they can create and change resources there through The Deployer. For a Git account, they can browse every repository in it. The screen warns you when you pick it.

What always stays with the owner

Whatever you share, only you, the workspace owner, can:

• add, verify, replace, reveal or delete a connection, or change its credentials;
• delete a service.

Admins hold every level on every service and connection, but they can't do the things in this list either. Teammates see a note on the Connections page saying the connections belong to you, and the add, replace, reveal and delete buttons aren't shown to them. A connection they can see but not use is marked see only.

Giving access

1. Open Team in the sidebar. On the Members tab, click the person.
2. In the drawer, find the Services and Connections sections.
3. For each, choose the scope:
   • No services / No connections: nothing beyond what their projects already show.
   • Chosen services / Chosen connections: pick items from the list and give each a level. Connections are grouped as Cloud accounts, Git accounts and Package repositories. Use the search box and the selection bar to set many at once.
   • All services / All connections: one level for every item, including ones you add later.
4. For services, tick Can reveal passwords where it's needed.
5. Click Save changes. An Undo appears for a moment if you change your mind.

You can set all of this when you invite someone too: in the invite, open Give access now.

Only the owner and admins can change who has access.

What each task needs

Some tasks need more than one permission:

• Creating a project or a blueprint: the Create projects permission, plus Use on the cloud account and on the Git account.
• Adding an environment to a project: Use on the cloud account the environment runs in.
• Creating a service: the Cloud services permission, plus Use on the cloud account it goes in.
• Attaching a service to a project: Use on the service, plus Connected services on the project. Detaching needs only Connected services on the project.
• Scanning a cloud account for existing apps: the Adopt existing apps permission, plus Use on that account.
• Using a package repository in a project's build: Build and packages on the project, plus Use on the repository.

Pickers in the app (new project, environments, adoption, the AI guide) list only what the person may use.

Taking access away

Changes apply on the person's next click.

• Projects already built on a connection keep working when you take the connection away. Only new use stops.
• Taking Can reveal passwords away doesn't make anyone forget a password they've already seen. If that matters, treat the password as known and change it.
• When a service or connection is deleted, or a member is removed, every grant on it goes with it. When a service is part of a handover, your team's grants on it are dropped.

Teammates who had Create projects, Adopt existing apps or Cloud services before per-item sharing existed kept what they could already use. The Team page asks you to check their access once; click Looks right when you have.

AI agents

An AI coding agent connected through The Deployer's MCP server works with the permissions of the person whose key it uses, minus anything that shows a secret: it never reveals service passwords. It can't change who has access. Sharing stays with you in the app. See use The Deployer from your AI coding tool.

Common problems

• A teammate can't find a connection when creating a project. They need Use on it, not only See, and on both the cloud and Git account.
• "Attaching this service needs the Use services permission." Give Use on that service, and check they have Connected services on the project.
• The Reveal button is greyed out. They need Can reveal passwords on that service.