How many team members can I invite?

Unlimited. Every paid Admaxxer plan (Starter, Growth, Pro, Scale, Enterprise) includes unlimited team seats. The only effective cap is the number of pending invitations a workspace can hold open at once, which protects against accidental spam — you can always cancel a pending invite to free up the slot.

Can a team member edit billing?

No. Only the workspace Owner can access billing — view invoices, change plans, update the payment method, or cancel the subscription. Admins, Members, and Read-only members never see the billing page or the Stripe Customer Portal. This is enforced at the API middleware layer, not just hidden in the UI.

What happens when an invite expires?

Invites are valid for 7 days from the moment they're sent. After that the signed token fails verification and the recipient sees an 'invitation has expired' message. Cancel the stale invite from the team page and send a new one — the new invite generates a fresh 256-bit signed token with its own 7-day window.

Can I have multiple workspaces?

Yes. One Admaxxer account (one user, one email) can own or belong to many workspaces. Each workspace has its own connections, members, billing, and quotas — there is no shared data between workspaces. The workspace switcher in the sidebar lets you jump between them; the active workspace is stored on your user record so it persists across sessions and devices.

Can I be in multiple workspaces?

Yes. The same email address can belong to many workspaces, each with its own role. You can be Owner of your own workspace and a Member or Admin in someone else's. The workspace switcher in the sidebar shows the role badge next to each workspace name so you always know which permissions you have where.

Does removing a member delete their data?

No. Removing a member revokes their access to the workspace immediately and clears their active_workspace_id if it pointed at this workspace, but the user account itself, any chat threads they authored, and any audit-log entries attributed to them are preserved on the workspace. Re-inviting the same email later restores access without losing history.

Are read-only members charged the same?

Seats are unmetered on every paid Admaxxer plan, so adding a Read-only member costs nothing extra. The plan price is the same whether you have 1 seat or 30. Read-only is purely a permissions tier — useful for finance, executives, or external partners who need visibility but should never run AI write actions or modify connections.

How do I transfer ownership?

Today, ownership transfer is not self-serve from the team page. The Owner is set when the workspace is created and stays with that user for the lifetime of the workspace. To transfer ownership — for example, when a founder hands the company off, or when an agency rebadges a client workspace — email support@admaxxer.com from the current Owner's address with the email address of the new Owner. We verify both sides before flipping the role.

What's the difference between Admin and Owner?

Owner is the original creator of the workspace and is unique — there is exactly one per workspace. The Owner has all permissions and is the only role that can edit billing and (via support) transfer ownership. Admin is a delegated power role: full team-management for non-Admin roles, full connection-management, full AI agent access, but no billing access and cannot promote or demote other Admins. Most organizations promote one or two trusted teammates to Admin so the Owner is not the bottleneck.

What happens if I leave a workspace?

Non-Owners can leave any workspace at any time via the 'Leave workspace' button on the team page. Your access ends immediately and your active_workspace_id is cleared if it pointed there. Owners cannot leave their own workspace — to give it up, transfer ownership to another member first via support, then leave. Leaving does not delete the workspace itself; the remaining members continue to use it as before.

Do pending invites count toward my team-size cap?

Pending invites are tracked alongside accepted members so accidental spam can't bypass the per-workspace ceiling. Since seats are unlimited on every paid plan, this rarely matters in practice — but if you ever want a strict limit (e.g. for an Enterprise contract that caps seats), pending invites count.

What does 'this invitation was sent to X' mean?

Invites are bound to the email they were sent to. If the recipient clicks the link while logged in as a different email, Admaxxer refuses to redeem and shows 'this invitation was sent to X' (where X is the original invitee's email). This prevents a leaked or forwarded link from being claimed by someone other than the intended recipient. Sign out and sign back in as the invited email, then click the link again.

Documentation · Team & Workspaces.

Invite your full performance team to one workspace.

Every invite, every member, every role tracked centrally — Owner, Admin, Member, and Read-only with a clean permission matrix and unlimited seats on every paid plan.

Open team settings Back to docs

Overview

Admaxxer is built for DTC brands and agencies running Meta and Google ads — the kind of workflow where multiple humans (a media buyer, a creative strategist, an analyst, a finance lead) need to look at the same data at the same time, sometimes from different time zones. Team management gives every workspace a single members list with roles, an invite flow that does not require the recipient to already have an Admaxxer account, and a permission model designed around the actual sensitivities: who can edit billing, who can paste a long-lived Meta token, who can let the Maxxer AI agent pause campaigns.

The model is workspace-scoped. A workspace is the unit that owns the Stripe subscription, the Meta and Google connections, the pixel install, the dashboards, the chat threads, and the audit log. Members belong to a workspace, not to a global Admaxxer account — so you can be the Owner of your in-house brand workspace and an Admin in your agency's client workspace without any data crossing between the two. Switching workspaces is one click in the sidebar; the active workspace persists across sessions and devices.

Seats are unlimited on every paid plan (Starter through Enterprise), so the team page does not show a "buy more seats" CTA and you do not have to worry about budgeting for new hires. Pending invitations count toward the per-workspace cap so accidental spam can't bypass it; cancel any invite from the team page to free a slot.

Roles + permission matrix

Four roles, picked deliberately so the common cases (a founder, two trusted seniors, the rest of the team, plus a finance or exec viewer) map cleanly. The matrix below is exhaustive — every permission Admaxxer enforces lives in this table.

Admaxxer role + permission matrix — what each role can and cannot do.
Role	Invite members	Remove members	Change roles	Edit billing	Manage connections	AI agent — write actions	View dashboards	View reports	View AI chat
Owner	Yes	Yes (any role except themselves)	Yes (including promoting/demoting Admins)	Yes (sole)	Yes	Yes (with destructive-tool confirmation)	Yes	Yes	Yes
Admin	Yes	Yes (Members + Read-only — never Admins or the Owner)	Member ↔ Read-only only (cannot promote/demote Admins)	No	Yes	Yes (with destructive-tool confirmation)	Yes	Yes	Yes
Team Member	No	No	No	No	Yes (paste/refresh tokens, reconnect)	Yes (with destructive-tool confirmation)	Yes	Yes	Yes
Read-only	No	No	No	No	No	No (UI hides destructive tools)	Yes	Yes	Yes (read mode — cannot fire write tools)

Notes on the matrix

Owner is unique. There is exactly one Owner per workspace, set at creation time. The Owner sees and acts on everything; in particular, the Owner is the only role with access to /billing and the Stripe Customer Portal.
Admin cannot self-elevate. An Admin can promote a Member to Admin in some products; in Admaxxer, only the Owner can promote or demote Admins. This prevents an Admin from collapsing the trust hierarchy after a single account compromise.
Read-only is enforced server-side. The UI hides destructive AI agent tools for Read-only members, but the API also rejects them — even if a Read-only user crafts a request directly against /api/v1/*, the backend returns 403.
Connection management is a Member-level permission. Members can paste / refresh Meta and Google tokens because day-to-day media buyers need to keep tokens fresh; rotation is part of the job, not a privileged escalation. Read-only members cannot.

How invites work

The invite flow is designed so the recipient does not need an Admaxxer account first — the email link both creates the account (if needed) and joins them to the workspace.

Open /settings/team as Owner or Admin.
Enter the recipient's email address and pick the role they should receive (Admin, Member, or Read-only — only the Owner can issue Admin invites).
Click Invite. Admaxxer generates a 256-bit signed token with a 7-day expiry, persists a row in the workspace_invites table, and sends the invitation email via Resend.
The recipient clicks the link in the email. The link points at /invite/accept?token=…. If they're not signed in, Admaxxer takes them through magic-link or Google sign-in for the email the invite was sent to. If they're already signed in as a different email, the page tells them to switch accounts (see "Email-mismatch protection" below).
On successful redemption, the user is added to workspace_members with the chosen role, their users.active_workspace_id is set to this workspace so they land on its dashboard, and the invite row is marked accepted.

Email-mismatch protection

The invite token is bound to the email it was issued for. If the link is forwarded, leaked, or copy-pasted, the recipient must sign in with that exact email to redeem — Admaxxer refuses to accept the invite for any other identity and shows the message "this invitation was sent to X". This prevents the common abuse pattern where a forwarded invite link is claimed by an outside account.

What the email contains

The invitation email includes the workspace name, the inviter's display name, the assigned role, the 7-day expiry, and the accept link. There is no plaintext token in the email body — the token lives only in the link's query string, where it is one click away from being verified and consumed.

Pending invites + cancellation

The team page lists every pending invite alongside accepted members. Pending invites count toward the per-workspace member cap (so spamming invites does not bypass any tier limit), but since seats are unlimited on every paid plan this is mostly a guardrail rather than a constraint. Each row shows the invited email, the assigned role, who sent it, and how many days remain until the token expires.

Cancel an invite at any time by clicking the cancel button on its row. Cancellation marks the invite row revoked. If the recipient now clicks the link, Admaxxer shows "this invitation has been revoked" and refuses to redeem — there is no way to undo a cancellation, only to send a fresh invite, which generates a new token with a new 7-day window.

Cancellation is the right move whenever an invite is wrong (wrong role, wrong email, sent in error) — there is no need to email the recipient asking them to ignore the link. Just cancel and re-send.

Removing a member

Removal happens from the team page. The remove button appears next to every row the current user is allowed to remove. The rules:

The Owner can remove any non-Owner member.
An Admin can remove Members and Read-only members. An Admin cannot remove another Admin or the Owner.
Members and Read-only members cannot remove anyone.
Nobody can remove the Owner. To replace the Owner, transfer ownership first (via support — see below).

When a member is removed, their access ends immediately. Open dashboards in their browser stop responding (the next API call returns 403 and the SPA bounces them to the workspace switcher). Their active_workspace_id is cleared if it still pointed at this workspace, so they don't land in an inaccessible state on next sign-in. Their user account, any chat threads they authored, and any audit-log entries attributed to them are preserved on the workspace — re-inviting the same email later restores access cleanly.

Owner ownership

The Owner is set when the workspace is created and is unique per workspace. The Owner has all permissions, is the only role with access to /billing, and cannot be removed or demoted from the team page. Today there is no in-product transfer flow — to hand off ownership (e.g. when a founder leaves or when an agency rebadges a client workspace), email support@admaxxer.com from the current Owner's address with the email of the new Owner. We verify both sides before flipping the role.

Owners cannot leave their own workspace. Non-Owners can leave any workspace at any time via the "Leave workspace" button on the team page; this is the symmetrical action to being removed by an Admin or Owner.

Tier limits — seats are unlimited

Every paid Admaxxer plan grants unlimited team seats: Starter ($9/mo), Growth ($29/mo), Pro ($79/mo), Scale ($199/mo), Enterprise ($499/mo). The plans differ on tracked-event volume, ad-account connection counts, and AI chat quotas — but never on team size. This is deliberate: you should never have to choose between adding the right teammate and staying on the right plan for your business.

Pending invites count against the per-workspace ceiling (so accidental spam does not bypass it). Annual plans give you ~17% off the equivalent monthly cost. See the pricing page for the full breakdown and the billing documentation for the lifecycle details.

Troubleshooting — invite + accept errors

Common error messages and what they mean:

"Invitation has expired": The 7-day window has passed. From the team page, cancel the stale invite (or it will be auto-cleaned), then send a new one. The new token is independent — clicks on the old link continue to fail.
"This invitation was sent to X": You're trying to redeem the invite while signed in as a different email. Sign out, sign back in as X (the invited email), then click the link again. This message is the email-mismatch protection — it prevents leaked links from being claimed by an outside account.
"This invitation has been revoked": An Owner or Admin cancelled the invite from the team page after it was sent. Ask them to send a fresh invite if it was cancelled in error.
"You're already a member of this workspace": The email is already on the members list. There's nothing more to do — sign in normally and the workspace will appear in your switcher. If you don't see it, check that you're signing in as the same email that received the invite.
"This invitation has already been accepted": The link was clicked once and redeemed. Each invite link is single-use — after acceptance the row is marked complete and the link cannot be re-redeemed. Sign in normally to access the workspace.

If none of the above applies and the invite still fails, email support@admaxxer.com with the workspace name, the invited email, and a screenshot of the error. We can resend a fresh invite from the support side and clean up any orphaned rows in workspace_invites.

API access — programmatic team management

Everything the team page does is also available over the Admaxxer REST API. Generate an API key from Settings, then call the workspace endpoints under /api/workspace/*: list members, create invites, cancel invites, change member roles, and remove members. The API uses the same role + permission rules as the UI — an API key minted by an Admin cannot remove another Admin, just like the Admin can't from the team page.

Full reference, including request/response shapes and rate limits, lives at /documentation/developer. The same /api/workspace/* endpoints power the in-app team page, so you can be confident the API is a first-class surface and not an afterthought.

Frequently asked

How many team members can I invite?: Unlimited. Every paid Admaxxer plan (Starter, Growth, Pro, Scale, Enterprise) includes unlimited team seats. The only effective cap is the number of pending invitations a workspace can hold open at once, which protects against accidental spam — you can always cancel a pending invite to free up the slot.
Can a team member edit billing?: No. Only the workspace Owner can access billing — view invoices, change plans, update the payment method, or cancel the subscription. Admins, Members, and Read-only members never see the billing page or the Stripe Customer Portal. This is enforced at the API middleware layer, not just hidden in the UI.
What happens when an invite expires?: Invites are valid for 7 days from the moment they're sent. After that the signed token fails verification and the recipient sees an 'invitation has expired' message. Cancel the stale invite from the team page and send a new one — the new invite generates a fresh 256-bit signed token with its own 7-day window.
Can I have multiple workspaces?: Yes. One Admaxxer account (one user, one email) can own or belong to many workspaces. Each workspace has its own connections, members, billing, and quotas — there is no shared data between workspaces. The workspace switcher in the sidebar lets you jump between them; the active workspace is stored on your user record so it persists across sessions and devices.
Can I be in multiple workspaces?: Yes. The same email address can belong to many workspaces, each with its own role. You can be Owner of your own workspace and a Member or Admin in someone else's. The workspace switcher in the sidebar shows the role badge next to each workspace name so you always know which permissions you have where.
Does removing a member delete their data?: No. Removing a member revokes their access to the workspace immediately and clears their active_workspace_id if it pointed at this workspace, but the user account itself, any chat threads they authored, and any audit-log entries attributed to them are preserved on the workspace. Re-inviting the same email later restores access without losing history.
Are read-only members charged the same?: Seats are unmetered on every paid Admaxxer plan, so adding a Read-only member costs nothing extra. The plan price is the same whether you have 1 seat or 30. Read-only is purely a permissions tier — useful for finance, executives, or external partners who need visibility but should never run AI write actions or modify connections.
How do I transfer ownership?: Today, ownership transfer is not self-serve from the team page. The Owner is set when the workspace is created and stays with that user for the lifetime of the workspace. To transfer ownership — for example, when a founder hands the company off, or when an agency rebadges a client workspace — email support@admaxxer.com from the current Owner's address with the email address of the new Owner. We verify both sides before flipping the role.
What's the difference between Admin and Owner?: Owner is the original creator of the workspace and is unique — there is exactly one per workspace. The Owner has all permissions and is the only role that can edit billing and (via support) transfer ownership. Admin is a delegated power role: full team-management for non-Admin roles, full connection-management, full AI agent access, but no billing access and cannot promote or demote other Admins. Most organizations promote one or two trusted teammates to Admin so the Owner is not the bottleneck.
What happens if I leave a workspace?: Non-Owners can leave any workspace at any time via the 'Leave workspace' button on the team page. Your access ends immediately and your active_workspace_id is cleared if it pointed there. Owners cannot leave their own workspace — to give it up, transfer ownership to another member first via support, then leave. Leaving does not delete the workspace itself; the remaining members continue to use it as before.
Do pending invites count toward my team-size cap?: Pending invites are tracked alongside accepted members so accidental spam can't bypass the per-workspace ceiling. Since seats are unlimited on every paid plan, this rarely matters in practice — but if you ever want a strict limit (e.g. for an Enterprise contract that caps seats), pending invites count.
What does 'this invitation was sent to X' mean?: Invites are bound to the email they were sent to. If the recipient clicks the link while logged in as a different email, Admaxxer refuses to redeem and shows 'this invitation was sent to X' (where X is the original invitee's email). This prevents a leaked or forwarded link from being claimed by someone other than the intended recipient. Sign out and sign back in as the invited email, then click the link again.

Next steps

Open the team page in your workspace and send your first invite.
See plans on the customer-facing pricing page — every paid tier includes unlimited seats.
Read the billing documentation for the Stripe lifecycle behind plan changes.
Admin user-management doc — the workspace-driven plan model the support team uses.
Developer documentation — programmatic team management via the Admaxxer REST API.
Back to documentation hub

Reference files: shared/schema.ts (workspaces, workspaceMembers, workspaceInvites tables), client/src/pages/settings/team.tsx (in-app UI), and /docs/ADMAXXER-CONNECTIONS.md for the broader workspace lifecycle.