Guides
Teams: invite, roles, offboarding and rotation
Bring people in, give them exactly what they need, and take it away cleanly.
1. Invite
Invite by email or StoreEnv username. Someone without an account gets an email, signs up and accepts. Roles are viewer, editor and admin; --env, --files and --keys narrow what they can read, --expires makes access temporary and --prod adds production access (owner only).
$ storeenv invite neha@example.com --role editor$ storeenv invite @bob --role viewer --env staging --expires 7d
2. Verify and share keys
Ask the new member for their fingerprint (storeenv whoami shows it) over a channel you trust, and record it. Until a device that can read the secrets wraps their keys, they show as pending key share; your next CLI command, or storeenv share, does it. The newcomer verifies you the same way, which makes your signed values trusted for them.
$ storeenv verify @neha SE:1A2B-3C4D-5E6F$ storeenv share
3. Change access
grant changes a role, scope, expiry or production access; narrowing removes key shares at once. Members ask for more with storeenv request; admins answer in the web app.
$ storeenv grant @bob --role editor --env staging$ storeenv request .env.production:API_URL --reason "Debugging"
4. Offboard
Access ends at once. Everything they could read gets new keys and is marked rotation due, and revoke lists those keys.
$ storeenv revoke @bob
5. Rotate
If they could have copied values, rotating at the provider is the only real protection: create new values there, push them, and revoke the old ones at the provider. The web app's rotation view lists what is due; admins get a weekly reminder by email.