Invite your team

Inviting someone to Crunu takes two people and three steps. You create an invitation link. They accept it and create their keys. You confirm them by comparing a key fingerprint, and only then do they get their environments. The comparison is what stops a server from slipping in keys of its own.

Owners and admins invite people. Only owners invite admins and owners.

Example. Kiteline is a fictional company. Priya invites Jonas as a Member with the Developers access profile, which makes him an Editor on development and staging.

1. Create the invitation

Open Members and choose Invite. In Invite member:

• Email: the person will sign in or create an account with this address.
• Organization role: Member gets only what's granted. Admin reaches all shared environments, members, machines, tokens and the audit log. Owner can also appoint admins and owners and manage the organization's settings. See Roles.
• Environment access after confirmation: choose environments and roles with Add environments…, and pick access profiles. You can also grant access later. Owners and admins don't need environments, because they reach all shared ones through the organization recovery key.
• How long the link stays valid, up to 7 days.

Create link shows the link once. Send it outside Crunu, for example in a chat message or by voice. The secret is in the part after #, which the server never sees, so the server can't swap the invited person's keys.

The invitation is signed by you. Your teammate's app and the confirming admin's app both check that signature, so the server can't change the role, the email or the access in it either.

2. Your teammate accepts

They open the link and see the organization, who invited them, the role and the expiry. The page checks that The organization key matches the one in the link.

• New account: they create an account with the invited email. If the server sends email, they first enter a 6-digit code sent to that address. Then they choose a password and get their Secret Key and Emergency Kit, as in Create your account.
• I already have an account: they sign in with the invited email and accept.

After accepting, they see Your key fingerprint: four groups of four characters, such as HT05 H2HP IIG5 U05H. They now wait for your confirmation.

3. Confirm with the fingerprint

Back in Members, the person appears under Awaiting confirmation. The card shows:

• that the keys came through the invitation link and their check code matches, so the server couldn't have replaced them;
• their fingerprint;
• What the member gets after confirmation.

Ask them to read their fingerprint to you on a call or in a message, and compare it with the card. If it matches, tick Fingerprint matches: verified with this person, then choose Confirm and grant access. Your app issues their certificate and seals the environment keys to them.

If it doesn't match, or you don't recognize the person, choose Reject.

Managing invitations

Invitations lists every invitation with its email, role, state, access, who created it and when it expires. States include Awaiting acceptance, Accepted, needs confirmation, Confirmed, Revoked and Expired. You can revoke an invitation that hasn't been used. An invitation works only once.

After confirmation

• The new member sees their environments on Projects.
• If they need more, they can request it. See Approve access requests.
• Ask them to turn on a second factor and create a recovery code right away.

Email addresses on self-hosted servers

When a server has email set up, a new account created from an invitation needs the code sent to the invited address, so nobody can create an account on someone else's address. On a self-hosted server without email, addresses aren't verified. The fingerprint comparison is then the only check, so invite addresses you know and always compare fingerprints.

Next: Install the agent.