> ## Documentation Index
> Fetch the complete documentation index at: https://tesser.sh/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Orgs, teammates, and CI

> How orgs work, how a teammate joins, and how a machine without a browser signs in

Everything in Tesser belongs to an org. A personal org has one member. A team
org has several members, and their boxes, the shared pinned instances, and
the service names all live in that org together. An account can belong to
more than one org, and `tesser login` asks which one to use when it matters.

## Orgs on this laptop

```sh theme={"theme":"css-variables"}
tesser org            # print the org every command runs in
tesser org ls         # list the orgs this laptop is signed in to
tesser org use <id>   # make a different one the default
tesser login --org <id>
```

Setting `TESSER_ORG=<id>` for a command uses that org for that command only.
`tesser whoami` prints the signed-in email and the current org.

## Adding a teammate

An owner runs:

```sh theme={"theme":"css-variables"}
tesser member add them@example.com
```

The next time that person runs `tesser login`, the browser offers them the
org. The Team tab on the [dashboard](https://tesser.sh/dashboard) does the
same thing through a form.

There are two roles, owner and member. Owners manage members, service env values, and the warm
pool, and they can operate on any box in the org. Members create and use
their own boxes and can wake the shared pinned instances. The last remaining
owner cannot be demoted or removed.

```sh theme={"theme":"css-variables"}
tesser member ls
tesser member role <membership_id> owner
tesser member rm <membership_id>      # also revokes every token that person holds
```

## Seeing each other's boxes

`tesser ls` lists every box in the org, including teammates' boxes, and
`tesser status` shows who owns a given box. Connecting to a box (syncing,
SSH, or viewing it in the browser) requires that box's key, which stays on
the laptop that created it, so you cannot open a teammate's dev box directly.
What a team shares are the pinned instances, such as one `api` at main that
everyone's boxes connect to. See [Wiring services together](/docs/wiring).

## Tokens and CI

A laptop signs in through the browser. A machine without a browser uses a
token created on the dashboard under Settings, CLI tokens:

```sh theme={"theme":"css-variables"}
export TESSER_TOKEN=tsr_api_…
export TESSER_ORG=org_…
tesser make api --ensure-running "$GITHUB_SHA"
```

You can also save such a token once with
`tesser login --token tsr_api_… --org org_…`. Tokens belong to one org, so a
token created in org A is not valid in org B. `tesser logout` revokes the
saved token and deletes it from disk.

Usage is metered per box-second and shown on the dashboard's Usage tab.