> ## Documentation Index > Fetch the complete documentation index at: https://docs.textql.com/llms.txt > Use this file to discover all available pages before exploring further. # Manage Workspaces > See and change several workspaces from one place: roles, members, settings, activity, and API keys ## Overview Manage Workspaces brings the workspaces you belong to into one place. You can see activity across them, give people roles in several workspaces at once, keep settings consistent, and create API keys that work in more than one workspace. Open it from the workspace switcher: click your workspace name, then select **Manage workspaces**. It opens on **Overview**, which lists your workspaces and, where you can see stats, how each one is doing. ![Manage Workspaces Overview page](https://mintcdn.com/textql/96dmsFMe2KgNor5Z/images/admin/manage-workspaces/overview.png?fit=max\&auto=format\&n=96dmsFMe2KgNor5Z\&q=85\&s=8545dec6ad7b9e13aa19f0e91fe29580) Overview, with stats across workspaces and the workspaces table ## Who Can Use It * **A signed-in browser session**: API keys and OAuth tokens can't use Manage Workspaces, because each is scoped to a single workspace * **Two or more workspaces in your switcher**: With SSO, only some of your workspaces may count. See [Single Sign-On (SSO)](#single-sign-on-sso) * **Permissions in each workspace**: Manage Workspaces never grants access you don't already have. Each page counts only the workspaces where you hold its permission, and appears once that count reaches two ## Single Sign-On (SSO) Manage Workspaces covers the same workspaces as your workspace switcher. Which ones those are depends on how you signed in. | You signed in to | You can manage | | - | - | | A workspace that uses [SSO](/core/admin/sso.md) | Other workspaces that use **the same identity provider** and allow your email domain | | A workspace that uses email sign-in | Other workspaces that use email sign-in | For example, if two of your workspaces sign in through the same Okta, you can switch between them and manage both together. A workspace on a different identity provider, or on email sign-in, doesn't appear. Sign in to it separately to work there. This keeps a session from one identity provider from reaching a workspace that trusts another. [Manage Workspaces API keys](#manage-workspaces-api-keys) follow the same rule: a key can only reach workspaces you could switch to from the session you created it in. ## Pages and Permissions Permission names match **Settings → Roles**. See the [Permission Reference](/core/admin/rbac.md#permission-reference) for what each one allows. | Page | Shown when you have | Extra, per workspace | | - | - | - | | **Overview** | Membership in 2+ workspaces | Stats and charts need **View stats** in 2+ workspaces on the new Observability experience. A workspace's numbers need **View stats** there, and its cost needs **View own usage** | | **People** | **View stats** and **View settings** in 2+ of those workspaces | Cost needs **View own usage**. Everyone's agents need **View any agent** | | **Insights** | **View stats** in 2+ of those workspaces | Thread links need **View own, shared & public** chats | | **Roles & members** | **Manage & assign roles** in 2+ workspaces | Role definitions need **View role permissions** | | **Capabilities** | **Manage settings** in 2+ workspaces | | | **Notification overrides** | **Manage settings** in 2+ workspaces | | | **API keys** | Membership in 2+ workspaces | Other people's keys need **View settings** in 2+ workspaces | | **Audit log** | **View audit log** in 1+ workspace | Shows only those workspaces | The extra permissions change what a workspace's row shows, never which workspaces you see. Where you lack one, that cell stays blank and the totals still cover every workspace. The Observability pages summarize the same data as each workspace's own [Observability](/core/admin/observability.md) page and link to it. Capabilities and Notification Overrides use the same settings as [Settings](/core/admin/settings.md#capabilities) in each workspace. ## Making Changes Changes to roles, members, capabilities, and notification overrides follow the same steps: 1. **Choose**: Pick what to change, or pick a workspace to copy from. A copy is exact 2. **Pick workspaces**: Only workspaces where you can make that change are offered 3. **Review**: See what changes in each workspace, shown as before and after. Nothing changes until you push 4. **Push**: Each workspace shows whether its change succeeded ![Set capabilities step in Manage Workspaces](https://mintcdn.com/textql/96dmsFMe2KgNor5Z/images/admin/manage-workspaces/set-capabilities.png?fit=max\&auto=format\&n=96dmsFMe2KgNor5Z\&q=85\&s=3c071b2e590456f0703ff1fc6641a353) Setting capabilities for several workspaces at once Each change needs these permissions in every workspace it reaches: | Change | Needs, in each workspace | | - | - | | Create or copy a role | **Manage & assign roles** and **Edit role permissions** | | Assign roles | **Manage & assign roles** | | Invite people | **Invite & remove** members | | Capabilities or notification overrides | **Manage settings** | | Revoke someone's API key | **Manage settings** | ### Role Names Pushing a role never changes an existing one: * **Same name**: If a workspace already has a role or group with that name, the push stops and says which workspace. Rename the role, or leave that workspace out * **Same permissions**: If a workspace already has a role with exactly the same permissions, that role is used instead of creating a duplicate ### Audit Trail Every change is recorded in that workspace's own [Audit Log](/core/admin/audit-log.md), tagged as made from Manage Workspaces. The **Audit log** page in Manage Workspaces lists those entries across your workspaces, and you can search and filter them by workspace. ## Manage Workspaces API Keys A regular [API key](/core/admin/api-keys.md) works in one workspace. A key created from **Manage workspaces → API keys** works in every workspace you add to it. The API calls these master keys. ### Creating a Key * **Workspaces**: Pick the workspaces it can reach, up to 200. You can only add workspaces you could switch to yourself * **Expiry**: Keys expire after 90 days by default. You can choose an expiry of up to a year > [!WARNING] > > The secret is shown once, when you create the key. Store it somewhere safe. ### Using a Key The key itself doesn't call the API. Exchange it for a short-lived token for one workspace, then call the API with that token: ```bash theme={null} curl -X POST https://app.textql.com/rpc/public/textql.rpc.public.auth.PublicAuthService/MintMasterKeyToken \ -H "Content-Type: application/json" \ -d '{"masterKey": "", "orgId": ""}' ``` The response includes an `accessToken` that lasts 15 minutes, or until the key expires if that's sooner. Send it as `Authorization: Bearer `. In that workspace, the token acts as you, with your roles there, like a personal API key. Mint a new token when it expires. > [!NOTE] > > Each mint checks that you can still switch to that workspace. Leaving a workspace, or losing access to it, stops the key working there. ### Revoking a Key * **Your own key**: Revoke it to stop it working everywhere at once * **Someone else's key**: Admins with **View settings** in 2+ workspaces can see other people's keys that reach those workspaces. With **Manage settings** in a workspace, they can cut a key off from it, and the key keeps working in its other workspaces Tokens already issued stop working as soon as a key is revoked. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.