Docs Guides
Teams and access
Members, roles, single sign-on, SCIM, two-factor authentication and the audit log.
Members
Invite people under Settings → Members. Everyone signs in with email and password, GitHub or Google, or with your identity provider if you use SSO. Two-factor authentication is available on every plan and can be required for the whole workspace.
Roles
Roles are part of the Business plan and above, and are set per project.
| Permission | Owner | Admin | Developer | Viewer |
|---|---|---|---|---|
| View servers, services, jobs and history | ✓ | ✓ | ✓ | ✓ |
| Deploy, run jobs, restart containers | ✓ | ✓ | ✓ | |
| Use secrets in deploys | ✓ | ✓ | ✓ | |
| Read secret values | ✓ | ✓ | ||
| Connect and remove servers | ✓ | ✓ | ||
| Manage members and roles | ✓ | |||
| Billing and workspace settings | ✓ |
On the Free and Team plans, every member is an Admin and the workspace creator is the Owner.
Single sign-on
On Business and Enterprise, connect any SAML 2.0 or OIDC provider (Okta, Microsoft Entra ID, Google Workspace and others) under Settings → Single sign-on. You can require SSO for everyone and map identity-provider groups to project roles.
SCIM
On Enterprise, SCIM 2.0 provisioning creates, updates and removes members automatically when they change in your identity provider.
Audit log
Every change is recorded: deploys, rollbacks, job runs started by hand, secret changes, member and role changes, and server connections. Each entry has the actor, time, IP address and target.
$ fwoop audit --since 7d --project clinic-portal --format json > audit.jsonThe audit log is part of Business and above, and is kept for as long as your plan’s history (Enterprise can set custom retention).
Support access
Fwoop staff can’t see into your workspace by default. If you ask for help, you can grant support time-limited, read-only access, which is recorded in the audit log and can be revoked at any time.