Team & access

Invite your team with the right role, give CI and coding agents exactly the access they need, and see who changed what.

Roles

Invite people

apprail members invite [email protected] --role developer
apprail members
apprail members role [email protected] admin
apprail members remove [email protected]

• An invitation is a link for one email address, valid once for 7 days, and it only works for someone signed in with that address. Apprail doesn’t email it — send the link yourself.
• Invitations grant admin, developer, or viewer. To make someone an owner, invite them and then promote them.
• Removing someone cuts off their API tokens for the workspace immediately; what they created stays. Anyone except the last owner can leave with members remove and their own email.

API tokens

Create tokens in the console under Settings → API tokens. Each one says who will use it and what it may do, and never exceeds its creator’s role.

- run: curl -fsSL https://console.apprail.io/api/cli/install.sh | sh
- run: ~/.local/bin/apprail deploy shop/web --image ghcr.io/acme/web:${{ github.sha }}
  env:
    APPRAIL_TOKEN: ${{ secrets.APPRAIL_TOKEN }}   # a service account's CI token with Deploy access

Tokens start with ar_. Revoke one in the console at any time; it stops working immediately.

Service accounts

For CI pipelines and shared automation, create a service account instead of using a person’s token. Its tokens keep working when the person who set it up leaves, and everything it does shows in Activity under its own name, marked as a service account.

• Owners and admins create them in the console under Settings → API tokens → Service accounts, as a developer or a viewer — never an admin or owner.
• Each gets its own CI or coding-agent tokens with read, deploy, or full access. A viewer service account can only have read tokens; changing one to a viewer revokes its others.
• A service account can never sign in, and can’t manage members, tokens, or other service accounts.
• Deleting one revokes all its tokens at once; its history stays.

apprail service-accounts

Approvals

Protect production and every deployment there from a token, CI job, agent, git push, or developer waits for an owner or admin to approve it in the console. See Protect production.

Sessions

Sign in with GitHub, Google, or an Apprail account. The Account page lists where you’re signed in — browser, address, last used — and lets you end any session or all the others. A session lasts 24 hours; Sign out ends it and signs you out of the sign-in page too. Only you, in a browser, can see or end your sessions — not a token or an agent.

Activity history

Every change is recorded with who made it — a person, CI, a coding agent (and which token), or Apprail itself. Any member can search and export it.

apprail activity --by agent
apprail activity --action deployment. --since 2026-09-01
apprail activity --search billing --csv > activity.csv

Filter by who (person, ci, agent, system), action prefix, text, and dates; the CSV export holds up to 10,000 events. Variable values are never recorded.

Export your workspace

apprail export > workspace.json

One JSON document with your projects, environments, services and where they run, domains, jobs, uptime checks, data resources, members, alert channels, and registry names — without secrets. An owner signed in to the console can choose Export with values to include variable values; that’s recorded in activity, and tokens can’t do it. Database contents are exported with pg_dump through a tunnel, and bucket contents with any S3 tool.