> ## Documentation Index
> Fetch the complete documentation index at: https://docs.granvl.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Teams, roles & API keys

> Workspaces, teammate roles, and credentials for headless agents.

## Workspaces

A **workspace** groups everything: funnels, domains, brand kits, ad connections, analytics, and teammates. Most companies need one; agencies often run one workspace per client, switching from the sidebar's workspace menu. Your agent's OAuth connection follows your **active** workspace; API keys pin to the workspace they were created in.

## Teammates & roles

Invite teammates under **Settings → Team**. Roles gate the sensitive actions:

| Ability                                           | Owner | Admin | Member |
| ------------------------------------------------- | ----- | ----- | ------ |
| Build, publish, and edit funnels                  | ✓     | ✓     | ✓      |
| View analytics and campaigns                      | ✓     | ✓     | ✓      |
| Connect / disconnect ad accounts and integrations | ✓     | ✓     |        |
| Manage secrets (API keys, tracking credentials)   | ✓     | ✓     |        |
| See raw sync error detail                         | ✓     | ✓     |        |
| Manage team membership                            | ✓     | ✓     |        |
| Delete the workspace                              | ✓     |       |        |

Everything the workspace's agents and members do lands in the **activity log** (Settings → Activity), so there's always an answer to "who changed this".

## API keys (headless agents)

The normal connection is OAuth: your client prompts you to sign in and the session follows your workspace. **API keys** exist for the cases OAuth can't cover: headless agents, CI pipelines, and server-side automations with no browser to sign in from.

* Create keys under **Agents → Advanced** (or Settings → API). Each key is shown once at creation; store it in your secret manager.
* Send it as a Bearer token: `Authorization: Bearer YOUR_KEY` against `https://app.granvl.com/api/mcp`.
* Keys can be created with an expiry (30 days, 90 days, 1 year, or never) and revoked at any time; revocation cuts connected sessions immediately.
* Creating and revoking keys requires the secrets permission (Owner / Admin).

<Warning>
  Actions taken by an agent holding your credentials are your actions, including publishing pages and creating (paused) ad campaigns. Scope keys to what the agent needs, set expiries for temporary automations, and revoke anything you can't account for.
</Warning>