Inviting Members

Members are the people who can use your connections. Add them at Dashboard → Members & Access → Members.

Before you invite anyone

Two things should be true first, or people will arrive to an empty experience:

  1. A connection is Active — there's nothing to connect to otherwise.
  2. Tools are published and have role access — a published tool with no role access is invisible to non-admins.

The second catches people out constantly. As an admin you see everything, so a workspace can look ready when members would see nothing at all.

Inviting people

Click Invite people. One page covers one person or hundreds:

  1. Who — paste addresses (one per line, or separated by commas), upload a CSV (email,name,role), or pick From an app's user list: the people a connection's app already knows, read from its User List Endpoint.
  2. Access — which connections, the roles everyone gets in each, and a platform role (Member is preselected). When your list carries people's own roles — a CSV role column, or the app's role field — map each value to a hub role, so a "Leasing Agent" gets your Leasing role.
  3. Review — every person with their final roles and where each came from, anyone skipped and why, the seats this uses and how many of today's invitation emails are left. Change any one person's roles here.
  4. Send — or untick Send invitation emails now to save them as Not sent yet and send later.

Paste a single address and the four steps collapse to one screen.

Each person gets one email. Someone new to LockMCP gets an email to set up their account, worded as your invitation; someone who already has an account gets the invitation. Its link lasts 7 days.

Assign a role at invite time. A member with no role can sign in and see nothing, which reads to them as a broken product rather than a configuration gap.

A source role in a list can only map to connection roles. The platform role is chosen on the page, so a file can never make someone an admin by naming them one.

Following invitations

Members & Access → Invitations shows each invite and its email:

  • Batches — one row per invite you sent: who, how, which connections, and progress (sent, failed, accepted). Open one for its people.
  • People — one row per person and connection, with the email's status. Filter by status (including Not sent yet), by email (Failed shows the reason), by connection or batch.

Select people — on the page, or all that match the filter — to Send, Change roles or Delete saved ones, or to Revoke, Resend or Retry failed ones that were sent. A failed email also shows as a red count on Members & Access in the sidebar.

Daily invitation allowance

A workspace can send a limited number of invitation emails per rolling 24 hours — every new invite, resend and sent draft counts; retrying a failed one doesn't. It stops a leaked key or account from mass-mailing. When an invite doesn't fit, nothing is sent and you're told how many are left. If you regularly need more, contact support.

Inviting from your own server

To invite people from your application — when someone is hired, or a customer adds a user — use the Invitations API with an API key for Invitations (Settings → API keys). It follows the same rules as this page.

Member status

StatusMeaning
InvitedInvitation sent, not yet accepted
ActiveSigned in and able to use the workspace
InactiveDeactivated — cannot sign in, but the record is retained

Managing a member

Select a member to see their details and actions:

ActionDoes
ResendSends the invitation again
Deactivate / ActivateBlocks or restores access without deleting
DeleteRemoves the member permanently

Deactivate is usually the right choice over Delete — it stops access while preserving the audit trail's attribution. Delete when someone was added in error.

Finding people

The Members tab supports search plus filters for Role, Status, Source (how they were added) and Connection. Once you're past a few dozen members, filtering by role is the fastest way to audit who has what.

How invitations differ by identity model

Who you invite depends on how the connection authenticates users:

Identity modelWho needs a LockMCP member record
Identity BrokeringEveryone. LockMCP holds the accounts, so people must be invited before they can sign in.
Token ExchangeUsers authenticate via your IdP, but still need to exist here. They must sign in to the dashboard once before tool calls resolve.
Tenant DelegatedUsers come from your app's directory and need no invitation to call tools. With a role mapping set in wizard Step 3, sign-ins assign the connection's roles and they can't be assigned in an invite; invite only for platform access. See Who assigns roles.

For Token Exchange, Authentication failed: user not found — please log in to the Dashboard first is the expected first-time error, not a fault. See Token Exchange Troubleshooting.

Offboarding

Deactivate or delete the member. They can no longer sign in.

For Identity Brokering and Token Exchange, an already-issued token stays valid until it expires. Removing a member prevents future sign-ins but doesn't instantly kill a live session. For immediate cutoff, also end their session under Sessions — see Monitoring & Audit.

Tenant Delegated is different: your validate endpoint is called on tool calls, so revoking the session in your own app cuts access on the next call.

Troubleshooting

SymptomCause
Invitation never arrivedCheck spam; then under Invitations → People, see the email's status — Retry failed if it failed, else Resend
"…of today's N are left"The daily invitation allowance — wait for it to free up, or contact support
Member signs in but sees no toolsNo role, or their role has no tool access
Member sees fewer tools than expectedRole's tool access is narrower than you think — check the role, not the member
"User not found — please log in to the Dashboard first"Expected on first connection for Token Exchange; they must sign in to the dashboard once

Where to go next