Team onboarding
Invite team members and set up per-developer device-based access to CipherStash, with traceable client keys you can grant and revoke individually.
Every developer on your team gets their own device and client key when they initialize CipherStash. This means every encrypt, decrypt, and secret access operation is traceable to a specific developer.
How team access works
When a developer runs npx stash init, CipherStash creates:
- A device tied to that developer's user account and device
- A client key associated with the device, used for cryptographic operations
- Automatic access to the default keyset in your workspace
No credentials are shared between developers. Each person has their own identity, and access can be granted or revoked individually.
Adding a team member
Invite them to your organization
In the CipherStash Dashboard, navigate to Members in the organization sidebar.
Add the new team member's email address. They will receive an invitation to create a CipherStash account (or join with an existing one).
Grant workspace access
Once they accept the invitation, grant them access to the relevant workspace(s) in Settings for your workspace.
Developer runs init
The new team member runs the init command on their device:
npx stash initThis authenticates them via the browser, creates their unique device and client key, and grants access to the default keyset.
They are now ready to develop locally with full CipherStash functionality — no environment variables needed.
Managing team access
Viewing active client keys
Navigate to Clients in the Dashboard to see all active client keys, including device-backed client keys created by npx stash init.
Each client key shows which developer and device it belongs to.
Revoking a developer's access
To remove a developer's access:
- Remove their client key from keyset access in the Dashboard
- Remove them from the workspace
- Optionally, remove them from the organization
Revoked client keys can no longer perform encrypt, decrypt, or secret operations.
Multiple devices
If a developer works on more than one device (e.g., a laptop and a desktop), they run npx stash init on each device.
Each device gets its own device identity and client key.
This is by design — you can revoke access per device without affecting their other devices.
Relationship to production
Team devices are for local development only. Production environments use separate application client keys configured with environment variables.
This separation ensures that:
- Developer credentials never appear in production infrastructure
- Production access is controlled independently from developer access
- Revoking a developer's device does not affect production systems
Next steps
- Getting started — The init guide to share with new team members
- Going to production — Set up application client keys for deployment
- Access keys — Understand access key roles
- Client keys — Learn more about device-backed and application client keys