---
title: "Workspaces, roles and adding a store"
source: "https://ottom.io/docs/workspaces"
summary: "A workspace shares stores between people. This page lists what an owner, an admin and a follower can each do, how invitations work, how a client’s store is added with its owner’s approval, and the second factors an account can use."
---

# Workspaces, roles and adding a store

A workspace shares stores between people. This page lists what an owner, an admin and a follower can each do, how invitations work, how a client’s store is added with its owner’s approval, and the second factors an account can use.

## Roles

### Owner

Everything an admin can, plus making somebody else an owner and changing or removing another owner. A workspace always keeps at least one owner: the last one cannot be removed or demoted.

### Admin

Invites and removes people, adds and removes client stores, and starts or cancels subscriptions. Cannot change an owner.

### Follower

Reads every report the workspace can read and receives its alerts and digests. Changes nothing and spends nothing.

## Invitations

- An invitation link lasts 14 days. An admin or owner can resend it.
- A workspace can have up to 20 invitations waiting at once.
- Only an owner can invite somebody as an owner.
- An invitation is for the address it was sent to, and joins that account.

## Adding a client’s store

A store joins a workspace only when whoever runs it agrees. There are two ways to show that.

### Approval by email

You name an address at the store’s own domain. We email that person a link, and the store joins the workspace when they approve it. Nothing you send can approve it for them.

### A DNS record

We give you a TXT record to publish on the store’s domain, and you check it once it has propagated. A store on a shared platform domain has no zone of its own, so it has to be added by its own domain or by email.

Publishing the record, step by step: https://ottom.io/docs/verify-store#agencies

A request that is not approved or verified expires after 14 days.

## Signing in securely

- Passkeys and an authenticator app, both added from Security in your account.
- The authenticator app gives a 6-digit code, and comes with 10 single-use recovery codes for when you do not have it to hand.
- Once an account has either, signing in with a password or an email link also asks for one of them. Signing in with Google or Shopify, or with a passkey, does not, because that sign-in is already a second factor.
- An owner or an admin can require two-factor sign-in for everyone in a workspace or on an account team. Anybody without a passkey or an authenticator app then cannot open its stores, reports or alerts until they add one. Only somebody who has one can turn the rule on or off, and every change is recorded with who made it and when.

## Questions

### Can an agency add a client’s store without the client knowing?

No. Either somebody at the store’s own domain approves it by email, or a record is published in a DNS zone the agency does not control. Both are the store saying yes.

### What does a follower cost?

Nothing. Subscriptions are per storefront, not per person, and a follower cannot start one.

### What happens when somebody leaves the workspace?

Their access ends at once, including the reports and the alerts. Membership is checked on every request rather than copied when they joined.