Inviting People

d2o PaaS is invitation-only. There is no self-serve signup: every account on the platform starts with an invitation. Members can send two kinds:

• Organization invitations make someone a member of your organization, with an organization role.
• Project invitations give someone access to a single project as a guest, with a set of project capabilities — without joining your organization at all.

Invitations are managed in the dashboard. The paas CLI has no invitation commands.

Invite someone to your organization

You need to be the organization’s Owner or an Admin.

1. In the dashboard, open your organization and go to Organization Settings → Members.
2. Click Invite Member.
3. Enter their email address, choose a role — Member, or Admin if you are the Owner (only the Owner can invite Admins) — and click Send Invite.

You cannot invite someone as Owner; every organization has exactly one, and ownership changes hands by transfer instead (see Transferring ownership).

A new Member has no project access until you add them to a group, so after they accept, put them in the right groups — see Groups & Project Permissions.

Invite a guest to a project

A project invitation is for people outside your organization — a contractor, or a collaborator from another company. Anyone who is the organization’s Owner or an Admin, or who holds the Manage project capability on the project, can send one from the project’s settings:

1. Open the project’s Settings → Members.
2. Click Invite Guest.
3. Enter their email, tick the capabilities they should hold (View is always included), and click Send Invite.

Instead of a role, a project invitation carries the set of capabilities the guest will hold on that project — the same capabilities you would grant a group. When they accept, they become a project guest: they can work in that one project, they never appear in your organization’s member list, and they see nothing of the organization beyond its name. Per-environment overrides do not apply to guests; their grant covers the whole project.

You cannot send a project invitation to someone who is already a member of the organization — give them access through a group instead. This is checked when you create the invitation, and checked again when it is accepted, so an invitation sent to someone who later joins your organization cannot be accepted either.

What the invitee experiences

A platform administrator can also invite someone directly to d2o PaaS. They get their own account and personal organization, without joining an existing organization. Accepting takes them to their personal organization, with the plan chosen for them if one was specified.

New to the platform: their account is created the moment you send the invitation, and they receive an email asking them to set a password. Once they have set it, they land on the invitation’s accept page. Their first sign-in also creates a personal organization of their own.

Already on the platform: they receive an invitation email with a link to the accept page. Existing users are never sent a password reset. The one exception is an account that was created by an earlier invitation but never had its password set: it gets a fresh set-password email instead.

The accept page shows who invited them, what they are being invited to, and the email address the invitation was sent to. From there:

• If they are not signed in, a Sign in to accept button takes them through sign-in and back to the invitation.
• If they are signed in as a different account, the page tells them the invitation is for another email address and offers Sign in as a different account. An invitation can only be accepted by the account it was addressed to.
• Accept invitation completes the process and takes them to the organization — or, for a project invitation, straight to the project.
• Not now defers; the link keeps working for 7 days, until the invitation is revoked, or until it is resent (a resend issues a fresh link valid for another 7 days and retires the old one).

If the link has expired, the page says the date it expired and asks them to get a new one from the person who invited them. If the link is invalid or already used, the page says “Invitation not found.”

Resend and revoke

Pending invitations are listed below the member list on the Members tab (and with the project’s members for project invitations). Each shows when it expires — “Expires in 5 days”, or “Expired 2 days ago” in red once its 7 days are up. An expired invitation stays in the list until you resend or revoke it.

• Resend sends a fresh link, valid for another 7 days, and retires the old one — use it when an invitation expired or the email went missing. If the person never set a password from their first email, the resend sends a new set-password email instead. Someone who already has a password is never sent a password reset.
• Revoke cancels a pending invitation. Its link stops working, and the person can no longer join. You can always invite them again later.

An invitation that has already been accepted no longer appears in the pending list; remove the person from the organization or project instead.

Limits

To keep invitations from being used for spam, a few limits apply. Only invitations that are actually sent count; a resend that is refused does not.

• An organization can have at most 25 pending invitations at a time. Revoke stale ones to make room.
• Each person can send at most 25 invitations in any 24 hours, resends included.
• An account in its first 30 days can send at most 5 a day, unless d2o PaaS invited it directly or the invitations are for an organization on a paid plan.
• An organization can invite one email address at most 5 times in any 24 hours.

Next steps

• Groups & Project Permissions — give new members access to projects
• Managing Your Organization — roles, members, and ownership transfer
• Access Control — how roles, capabilities, and guests fit together