Accounts & workspaces
Sign-in, members, roles and the boundary around your data.
Sign-in is OAuth only
Invoicey supports Google and GitHub. There is no email-and-password option and no plan to add one — the reasoning is that password storage, reset flows and breach handling are meaningful liabilities for a small invoicing tool, and both providers already do it better.
A provider only appears on the sign-in screen if the deployment has credentials configured for it. If you see one button where you expected two, that deployment has not set up the other provider.
Because both providers verify email addresses, account linking is on: signing in with GitHub using an address that already signed in with Google attaches to the same account. Linking across different addresses is deliberately not allowed.
Workspaces are the tenancy boundary
Everything you create — issuers, clients, invoices, presets, uploaded files, email history — belongs to exactly one workspace. Nothing is shared across workspaces, and no query returns rows from a workspace you are not a member of.
Your first sign-in creates a personal workspace automatically, so you never start on an empty setup screen. You can create more workspaces from the sidebar switcher whenever you need a separate tenancy boundary (different people, different books).
Workspace, not company
A workspace is not the same thing as an issuer. One workspace can hold several issuer businesses — your OSVČ trade and your s.r.o., each with independent numbering and bank accounts. Use separate workspaces only when different people need separate access.
Switching and creating workspaces
The sidebar shows your active workspace. Open the switcher to:
- Jump to another workspace you belong to
- Create a new workspace (you become its owner)
Switching reloads the app for that tenancy and also updates your default workspace (see API keys below). Creating a workspace switches you into it immediately.
Settings → Workspace lets owners and admins rename the current workspace and set a logo for the sidebar switcher. The slug is fixed after creation. The workspace logo is chrome only — invoice PDFs still use each issuer’s logo.
Members and roles
| Role | Can do |
|---|---|
| owner | Everything, including managing members. Assigned to whoever created the workspace |
| admin | Everything except transferring ownership |
| member | Day-to-day work: issuers, clients, invoices, sending |
Invite someone by email address. They get an email with a link; accepting adds them to the workspace with the role you chose, sets that workspace as active (and as their API-key default), and sends them to the dashboard. If the invitation email fails to send — for example on a deployment with no mail configured — the invitation row is still created and the link stays copyable from settings, so you can pass it along yourself.
Active workspace vs default workspace
Your browser session carries one active workspace, resolved when the session is created and updated when you switch. Every page, server action and tool call independently re-checks it — the redirect you see when signed out is a convenience, not the security boundary.
A personal API key binds to your default workspace instead — not to a cookie. Switching workspaces in the UI updates that default so automation follows where you work. Settings → API keys also lets you set the default without changing the browser session.
Security settings
Settings → Security covers the account itself:
- Linked accounts — connect or disconnect Google and GitHub.
- Sessions — see where you are signed in, and revoke any of them.
- Trusted devices — mark a device as known. Signing in from an unrecognised one triggers a soft alert email.
- Audit log — a record of security-relevant events, including API key creation and revocation.
Deleting things
- Draft invoices can be deleted outright.
- Issued invoices cannot. Cancel them instead — the number stays consumed, which is what Czech accounting expects. A gap in your invoice sequence is a question you do not want to answer during an audit.
- Clients and issuers referenced by issued invoices stay resolvable, because those invoices hold frozen snapshots rather than live references.