Help / Teams & access
Teams & access
Updated July 15, 2026
Sharing works in two steps, and they are genuinely different things: joining a workspace makes someone a member of your team, while granting a project hands them the key material to decrypt it. Being in the workspace does not, by itself, let anyone read a secret.
Add someone to the workspace
$ bippass members $ bippass members add --user-id <uuid> --role member
Roles are owner, admin, member and viewer.
Grant access to a project
This is the step that shares the ability to decrypt. The project key is re-sealed to that person's public key, so only they can open their copy — no plaintext key passes through the server, and nobody shares a password.
$ bippass grant --email dev@acme.com $ bippass grant --user-id <uuid> --project api
You must be able to decrypt a project yourself to grant it to someone else — your own key is what re-seals theirs. Run this from a machine where you are logged in and unlocked.
Asking for access instead
On paid plans, someone can request access to what they need and an approver decides, with both the request and the decision recorded in the audit log. That flow lives in the web app.