How do I get a workspace, and how do invitations work?

A workspace represents an isolated tenant organization in Pointer. This guide explains how workspaces come into existence, how owner invitations operate, link security rules, and what to do if email delivery is turned off.

How a workspace comes into existence

In Pointer, workspaces are not provisioned through uncontrolled public sign-up forms. Instead, a platform Super Administrator creates and provisions a new workspace by inviting the prospective workspace owner.

The primary invitation flow

1. Admin sends the invitation: In the Super Admin dashboard (under Admin → Tenants), the administrator enters:
   • The owner's email address.
   • An optional display name.
   • The selected subscription plan (e.g. Free, Starter, or Pro).
   • Link expiration in days (default is 7 days; maximum is 30 days).
2. No passwords in the invitation flow: There is no password field anywhere in the primary invitation screen. Neither the administrator nor the server generates or sees a temporary password.
3. The invitation email: Pointer sends an email containing a unique, cryptographically signed invitation URL.
4. The owner sets their own password: The invitee opens the link in their browser. The page prompts the owner to verify their name and choose their own secure password.
5. Immediate activation: Upon submitting the form, the workspace and the owner account are created and activated immediately. There is no second approval step, manual confirmation ticket, or administrative unlock required. The invited subscription plan takes effect immediately.

Single-use links and expiration

Workspace invitation tokens are strictly protected:

• Single-use (MaxUses = 1): An invitation link can be accepted exactly once. Once the owner sets their password, the token is marked as consumed. Any subsequent visit to the same link will fail cleanly.
• Expiration cap: Invitations expire automatically after their configured duration (7 days by default, capped at a maximum of 30 days). Expired tokens cannot be redeemed.

Managing invitations: Resend, Rotate, and Revoke

Super Administrators can manage active invitations from the Pending Invitations table in the Tenants screen:

• Resend: Re-sends the invitation email to the recipient's address and resets the expiration window, keeping the existing link valid.
• Rotate link (rotate=true): Invalidates the old token immediately and mints a brand-new invitation code. Use this if an invitation email was accidentally sent to an incorrect address or if the link may have been exposed.
• Revoke: Cancels the pending invitation entirely. Any person attempting to open or accept a revoked link receives an immediate 404 error.

Copy-link fallback when email delivery is off

When running a self-hosted Pointer instance where SMTP email delivery is not configured (or in local/staging test environments), Pointer detects that outbound email delivery could not be performed (emailSent === false).

Secondary path: Direct creation with password

Underneath the primary invitation form, an expandable disclosure labelled “Create directly (sets the password yourself)” allows an administrator to provision a workspace and manually set an initial password.

This path is provided strictly as a secondary fallback for air-gapped environments or automated provisioning scripts. In all standard customer onboarding workflows, the invitation flow is the strongly recommended standard so owners always control their own credentials.