Who can publish and change a website
Project and workspace roles, API keys, connected apps, Benchy and guests, and the record of who changed what.
Roles
A website has its project’s access, and a website with no project follows workspace roles. In a private project, the workspace’s Owner still manages the website’s domains and billing and can delete it, but can’t change what it shows. Moving a project to the Trash takes its websites offline, and purging the project deletes them.
| Role | What they can do |
|---|---|
| Can view | See the website, its versions, previews and domains, and its history through the CLI or an agent |
| Can edit | Also publish previews and live versions, roll back, take it offline, connect and remove domains, edit content, read and export form entries |
| Workspace Owner | Also permanently delete it in Studio |
A website with no project joins a project when a canvas from that project is published to it. That happens only when nobody loses it: if it’s a draft you made, the project is open to the workspace, or you’re the workspace’s Owner.
A guest on a project works on its websites at their project role, except domains and form entries, which are for members. Guests on a chat, canvas or doc don’t see websites in Studio; like anyone, they can open an address you share.
API keys and connected apps
A key or connected app reaches the one workspace it was made for, never doing more than its person could. See Connect your agent.
| Access | What it can do with websites |
|---|---|
| Read | See websites and their versions |
| Publish websites | Create a website, and publish, preview, roll back and take it offline. It can’t connect a domain, change content, read form entries or publish a canvas. Limit it to one website and it sees only that one, and reserves no new names |
| Read and write, Ask me each time, or a connected app | Everything a person with Can edit can do through the tools, except deleting. With Ask me each time, every change waits for your approval in Studio |
- For the CLI, a build script or CI, use a Publish websites key limited to one website, so a leaked key can only publish that website.
- Revoking a key or disconnecting an app stops it at once, mid-deploy included.
- No key or app can delete a website; the workspace’s Owner does that in Studio.
Benchy
Benchy acts with the role of the person who asked. The one change it makes to a website is publishing the canvas the chat is open on, to a website that already exists. Every publish, preview or live, asks first on a card naming the website and address, and “Always allow in this chat” never covers it. Rolling back, taking a website offline, changing content and connecting domains are yours.
Who did what
A website’s history records every deploy, rollback, offline switch, domain change and content save with the person and what it came through: Studio, the CLI, a named key, a connected app, or Benchy on their behalf. Read it with benchy site get or by asking your agent. See Versions and history.