Teams

Invite members, manage roles, and handle vault passphrase resets.

Sp00ky Cloud projects live inside a tenant. Every tenant has at least one admin and can have additional team members who share access to projects, deployments, and the Shared Vault.

Plan Limits

Plan	Included Members	Additional Members
Starter	1 (admin only)	+$5/mo each
Pro	Up to 5	+$5/mo each

Additional team members beyond the plan limit are billed as a metered add-on at $5 per member per month.

Inviting Team Members

Invite a new member by their GitHub email address:

spky team invite alice@example.com

If the Shared Vault is initialized, the CLI will prompt for your vault passphrase to securely transfer vault access to the new member. The invited user receives an email with a link to accept. They’ll authenticate via GitHub OAuth and set their own vault passphrase.

GitHub Account Required

Team members must have a GitHub account with the invited email address. Sp00ky Cloud uses GitHub OAuth for authentication.

Pending Invitations

View all pending invitations:

spky team invites

Revoke a pending invitation:

spky team revoke alice@example.com

Invitations expire after 7 days.

Listing Team Members

spky team list

Example output:

EMAIL                          ROLE       JOINED
------------------------------------------------------------
khadim@example.com             admin      2026-03-01
alice@example.com              member     2026-03-15
bob@example.com                member     2026-04-02

Removing Team Members

spky team remove alice@example.com

Warning

Removing a team member immediately revokes all access. Their copy of the vault encryption key is deleted and any API keys they created are revoked. This cannot be undone. You’ll need to re-invite them to restore access.

If a removed member previously loaded sensitive values, consider rotating those variables with spky env set.

Roles

Role	Capabilities
Admin	Full access. Manage billing, invite/remove members, create/destroy projects, deploy, approve vault resets.
Member	Access all projects. Deploy, view logs, manage environment variables via shared vault. Cannot manage billing or remove other members.

The user who creates the first project becomes the tenant’s admin. Additional admins can be added by inviting with the admin role.

Vault Passphrase Reset

If a team member loses their vault passphrase, an admin can approve a reset so they can set a new one. This does not affect other members’ passphrases or any encrypted data.

# Member requests a reset (admins are notified by email)
spky env reset request

# Admin approves the reset
spky env reset approve alice@example.com

# Member completes the reset with a new passphrase
spky env reset complete

See Passphrase Reset for the full details.

Renaming a Tenant

spky team rename "My Team"

CLI Reference

spky team <COMMAND>

Commands:
  list               List all team members
  invite <EMAIL>     Invite a user by their GitHub email
  invitations        List pending invitations
  revoke <EMAIL>     Revoke a pending invitation
  remove <EMAIL>     Remove a team member
  rename [NAME]      Rename the tenant