Skip to main content
Everyone on your desk signs in with their own passkey. There are no passwords and no email service: you add people by sending them an invite link, and they create a passkey when they open it.

​
Roles

Each person has one of three roles. In more detail: Agents see admin-only pages and settings read-only, without the buttons. The Get started checklist in the sidebar is for owners and admins only. Your own role shows in Settings → General (“Owners and admins change workspace settings; agents answer chats.”).

​
Invite a teammate

1

Open Settings → Team

Open Settings from the account menu at the bottom of the sidebar (or press g then s), then Team. Owners and admins see an Invite people card.
2

Pick a role and create the link

Choose Agent or, if you’re the owner, Admin. Press Create invite link.
3

Send the link

The link appears once, with Copy: “Send this link to the person you’re inviting. It’s shown only once.” Send it however you like (chat, email). The desk doesn’t send it for you.
4

They join

They open the link and see Join <your workspace>, “You’ve been invited as an agent.” (or an admin). They enter their name and email and press Create passkey and join. Their browser or password manager creates a passkey, and they’re signed in.Someone who already has an account on this desk (in another workspace) presses Join as <their name> if they’re signed in, or Sign in to join under the form. The workspace is added to their workspace menu; no new passkey.
Invite links work once and expire after 7 days. Pending invites are listed under Pending invites with who created them and when they expire; Revoke cancels one. Only a hash of each link is stored, so a lost link can’t be shown again: create a new one. Someone opening a used, revoked or expired link sees This invite link is invalid, used, or expired. Creating a new account with an email that’s already on the desk gives An account with that email already exists. Sign in with it to join.
The invite link uses the address you created it from. If you use a custom domain, create invites from that address so passkeys are made for it: a passkey only works on the domain it was created for.

​
Change a role or remove someone

The Members card lists everyone with their email. For people below your role, it shows a role menu and Remove:
  • The owner can switch anyone between agent and admin, and remove admins and agents.
  • Admins can manage agents only.
  • Everyone else’s role shows as a label.
Remove asks for confirmation (“They’ll be signed out and lose access.”). Removing someone takes them out of the workspace and stops notifications to their devices. If it was their only workspace, their account is deleted with its passkeys and sessions, so they’re signed out everywhere at once. Their past messages stay in your conversations, and the Dashboard lists them as Former teammate.

​
Passkeys

Each person manages their own passkeys in Settings → Passkeys (Your passkeys).
  • Add passkey registers another one, for example on your phone or a second computer. Add at least one more so you can’t get locked out.
  • Each passkey shows when it was added and last used. synced means your passkey provider backs it up and syncs it across your devices (iCloud Keychain, Google Password Manager, 1Password and similar).
  • Remove deletes a passkey. You can’t remove your only passkey: add another one first.
Signing in is Sign in with passkey on the desk’s sign-in page. New people can’t sign up there; the page tells them to ask an admin for an invite link.
If an agent or admin loses every passkey, they can’t recover access themselves. Remove them and send a new invite. The owner can recover with the setup token: see First sign-in.

​
Settings overview

Settings opens as a dialog over the page you were on. Each section has its own address (/settings/<section>), so you can link to it. The Theme switch at the bottom of its menu cycles between system, light and dark. The chat widget’s look and install snippet are on the Chat widget page, not in Settings. Your API tokens for the jun CLI and your own AI are on the MCP page in the sidebar. See MCP. See Appearance and Install. You can also jump to any settings section from the command palette (Ctrl K): type its name, for example Settings: Team.

​
Workspaces

One desk can run several websites or products. Each one is a workspace with its own chat widget and widget key, inbox, AI agent and settings, knowledge, team, API tokens and notifications. Nothing is shared between them except the desk itself: its address, its Worker secrets (such as JUN_SECRET_* keys, GITHUB_TOKEN) and the setup token.
  • Switch: the workspace’s name at the top of the sidebar opens a menu with your workspaces. Pick one to open it.
  • Addresses: every page lives under its workspace, /w/<workspace>/… (for example /w/acme/inbox or /w/acme/settings/team), so each browser tab stays on its own workspace and a copied link opens the right one. The <workspace> part comes from the name when the workspace is made and stays the same when you rename it. Addresses in these docs like /agent or /settings/ai are the part after it; typed without it, they open in the workspace you used last.
  • Create: owners see New workspace in that menu. Give it a name; you’re its owner, and it opens on Get started to add its docs, set up its AI and install its widget on its website.
  • Rename: Settings → General → Workspace (owners and admins). Customers see the name until the chat widget has its own.
  • Delete: Settings → General → Delete workspace (owners). Type its name to confirm. It deletes the workspace’s conversations, contacts, knowledge, AI agent, widget and API tokens for good, and its widget stops working on your website. Teammates who were only in that workspace lose their account. You can’t delete your only workspace.
Teammates are per workspace: invite people from each workspace’s Settings → Team. One person can be in several workspaces with one account and a different role in each. Notifications are per workspace too: turn them on in each workspace’s Settings → Notifications. A notification opens its conversation in the right workspace. An API token belongs to the workspace it was made in, so the jun CLI and your own AI over MCP work on that workspace. Make a token in each workspace you want to reach.

​
Next steps

The inbox

Where your team answers chats.

First sign-in

The owner account, the setup token and recovery.