Start here
Account creation
How sign-in, organizations, members and the five membership roles work in PWR Studio, including current limitations.
Everything in PWR belongs to an organization. You sign in as a user, create or join an organization, and your role in that organization decides what you can do.
Signing up and signing in
PWR Studio signs you in with an email address and password.
To create an account, open Create account in PWR Studio (or follow Start building from pricing, which also remembers the plan you picked):
- Enter your email address and a password of at least 10 characters, and accept the terms.
- Open the confirmation link sent to that address. The email address must be verified before PWR accepts your session.
- Create your organization. If you picked a plan, the next screen asks you to confirm it before checkout.
If the confirmation email does not arrive you can resend it from the same screen. Forgot password? on the sign-in screen sends a link to choose a new password. Your user record in PWR is created automatically on your first authenticated request.
Status: Registration, email confirmation and password reset are implemented in PWR Studio against the Supabase Auth client and covered by automated tests with a simulated provider. They have not yet been exercised against a live Supabase project.
There is currently no single sign-on in the product. SSO is listed as a feature of the Enterprise plan in the draft plan catalog and is not implemented.
Organizations
On first sign-in you are asked for an Organization name and an optional slug (lowercase letters, digits and hyphens; derived from the name if you leave it). You become the organization's owner. You can belong to several organizations and switch between them in PWR Studio.
An organization holds your projects, agents, tasks, provider credentials, integrations, repository connections and audit log. Data is isolated per organization: a request for another organization's resource is answered with 404, as if it did not exist.
Members
Open Settings → Members to see who has access and to add people. Admins and owners can add, change and remove members.
Status: There are no invitation emails yet. A person can only be added by email after they have signed in to PWR at least once. Adding an unknown email returns
404. Pending invitations are planned.
A member can always remove themselves. An organization must keep at least one owner; an attempt to remove or demote the last one is refused with 409 last_owner.
When billing is enabled and the organization has an active subscription, the plan's member limit applies. Adding a member beyond it is refused with 403 plan_limit_members. See Billing and credits.
Roles
There are five membership roles, ordered by privilege:
owner > admin > developer > reviewer > viewer
| Action | owner | admin | developer | reviewer | viewer |
|---|---|---|---|---|---|
| View organization, members, projects, tasks, agents | ✓ | ✓ | ✓ | ✓ | ✓ |
| Update organization name | ✓ | ✓ | |||
| Add, change or remove members | ✓ | ✓ | |||
| Assign or remove the owner role | ✓ | ||||
| Create or update projects | ✓ | ✓ | ✓ | ||
| Archive projects | ✓ | ✓ | |||
| Set a project's workspace source or validation command | ✓ | ✓ | |||
| Create or update agents; add, rotate or revoke credentials | ✓ | ✓ | |||
| Register integrations, approve tools, grant tools to agents | ✓ | ✓ | |||
| Connect GitHub and repositories | ✓ | ✓ | |||
| Create, edit, queue, cancel and retry tasks | ✓ | ✓ | ✓ | ||
| Approve or reject a task | ✓ | ✓ | ✓ | ✓ | |
| Read the audit log | ✓ | ✓ | |||
| Subscribe to a plan, open the billing portal, set budgets | ✓ | ||||
| Buy a credit top-up | ✓ | ✓ |
Who may approve a pull request and who may merge are set per project in the workflow policy. The defaults are reviewer to approve and admin to merge. See GitHub integration.
Admins can currently change or remove other admins. Owners are protected: only an owner can grant or revoke the owner role.
Roles are enforced by the API on every request, not only hidden in the interface.
Sessions
- Your session is a signed token sent with every request. Tokens are verified with an explicit algorithm allowlist; issuer, audience and expiry are checked.
- PWR Studio does not yet refresh an expired session automatically. When it expires you see "Your session expired. Please sign in again." and sign in again.
- Sign-in attempts are rate limited per client IP and per target account.
Audit log
Every action that changes something is written to an append-only audit log with the actor and a request id. Admins and owners can read it under Settings → Audit.