A workspace holds your funnels, domains, brands, ad connections, analytics, and teammates. Each workspace also has its own plan, credits, and API keys. Use this article to decide who can do what, and how people and agents get in.
Roles and permissions
Every member of a workspace has one of three roles. Members do the day-to-day work. Owners and Admins also control access, credentials, domains, and money.
What you can do | Owner | Admin | Member |
Build and edit pages and variants | Yes | Yes | Yes |
Publish and unpublish funnels | Yes | Yes | Yes |
Choose where a funnel's leads go (form destinations, SMS verification) | Yes | Yes | Yes |
Run research and generation that spends Tool credits | Yes | Yes | Yes |
Connect ad platforms, CRMs, and other credentials, including tracking tokens and custom scripts | Yes | Yes | No |
Add, verify, and remove domains | Yes | Yes | No |
Delete funnels and clear analytics | Yes | Yes | No |
Create and revoke API keys | Yes | Yes | No |
Choose a plan, buy credits, and set Ad Guardrails | Yes | Yes | No |
Turn lead receipts, AI funnel analysis, and generation regions on or off | Yes | Yes | No |
Invite teammates, change roles, remove members, and rename the workspace | Yes | Yes | No |
The Owner is the person who created the workspace. The Owner's role can't be changed, and the Owner can't be removed.
Agents follow the same rules. A tool call is checked against the role of the person whose connection made it, so an agent can't do anything its person couldn't do in the dashboard.
Invite a teammate
Before you begin
You need the Owner or Admin role.
Make sure the right workspace is active in the workspace switcher.
Steps
Open Settings > Workspace.
Click + Invite teammate.
Enter the Email address.
Choose a Role: Member or Admin.
Click Send invitation.
They get an email with a link to join. Until they accept, they appear in the members list with an Invited chip and the date the invitation expires. Invitations expire after 14 days. To cancel one, click Revoke on its row.
When someone accepts an invitation, the new workspace becomes their active workspace.
Change a role or remove someone
Open Settings > Workspace.
In Members, find the person.
Pick Admin or Member in their role menu. The change applies right away.
To remove them, click Remove and confirm.
You can't change your own role. Ask another Admin. Removing someone also stops their API keys and agent connections from reaching this workspace.
Your agent can do the same with list_team_members (members, roles, and pending invitations) and set_team_member_role (Admin or Member only). Confirm before promoting anyone to Admin.
Work in more than one workspace
You can belong to several workspaces, for example your own and one a colleague invited you to. Each one is separate: its own funnels, domains, brands, plan, trial, credits, members, and API keys.
To switch:
Click the workspace name at the bottom of the sidebar.
Under Workspaces, pick the one you want. The active one is marked Current, and the others show your role.
granvl opens Home in that workspace.
Workspace settings at the bottom of the same menu opens Settings > Workspace.
Switch workspaces from your agent
Agents connected with OAuth work in your active workspace. When you switch in the dashboard, your agent follows on its next tool call. You can also ask your agent to switch:
list_workspaceslists every workspace you belong to, with its id, name, your role, and which one is active.switch_workspacemakes another one active. Pass its id or exact name. The switch applies from the next tool call.
List my granvl workspaces, then switch to the one called Acme Roofing.
switch_workspace is refused on API-key connections. A key belongs to one workspace.
Choose OAuth or an API key
OAuth | API key | |
Acts as | You, with your role | The person who created the key, with their current role |
Workspace | Your active workspace, and it can switch | Only the workspace the key was created in |
Use it for | Agents that sign in, such as Claude, ChatGPT, Grok Bot, and Cursor | Scripts, CI jobs, and clients that only accept a bearer token |
Loses access when | You're no longer a member of the workspace | The key is revoked or expires, or its creator leaves the workspace |
For client setup, see Connect Claude, ChatGPT, Grok Bot, Cursor, or another agent.
Create an API key
Before you begin
You need the Owner or Admin role.
Switch to the workspace the key should work in. The key is bound to it.
Steps
Open Settings > API, or the MCP page from the sidebar.
Click + New API key.
Enter a Key name that tells you which tool uses it, such as "Claude Desktop".
Click Create key.
Copy the key. It's shown once and can't be shown again.
Store it in your password manager or secret store, never in public code.
Point your client at the MCP endpoint and send the key as a bearer token:
Endpoint: https://app.granvl.com/api/mcp
Header: Authorization: Bearer YOUR_KEY
Keys created in the dashboard don't expire. Revoke a key when you no longer need it.
Revoke an API key
Switch to the workspace the key belongs to.
Open Settings > API or the MCP page.
Find the key by its name and prefix. Each row shows when it was created and last used.
Click Revoke and confirm. Tools using it stop working immediately.
Revoke any key you can't account for, or one you think has leaked. Settings > API also has Disconnect Zapier, which cuts off every Zapier token issued for your account.
Sign out everywhere in Settings > Profile ends your granvl sessions on every device. It doesn't revoke API keys or the Zapier connection.