Signing in, roles and what only people can do

Sign in with an emailed code or Google. Each workspace member is an owner, editor or viewer, and some actions always need a person in the web app.

You sign in to Wavefront with a code sent to your email or with your Google account. In each workspace you’re an owner, an editor or a viewer, and your role decides what you can do there. A few actions always need a person signed in to the web app, whatever an agent or API key is allowed.

Email code. Enter your email and choose Email me a code. Enter the 6-digit code and choose Sign in. A code lasts 5 minutes and works once. You can ask for a new one after 30 seconds with Send a new code, or choose Use a different email.
Google. Choose Continue with Google.

Signing in for the first time creates your account. There’s no password to remember or reset.

A browser stays signed in for 14 days. To sign out of every other browser, open Account (in the menu at the bottom of the sidebar) and choose Sign out other sessions. The browser you’re using stays signed in.

Your account page

Account holds your pending invitations, your Display name (shown on your work, reviews and comments), the theme (system, light or dark), the workspaces you belong to, and your sessions.

The three roles

Role	What it can do
Owner	Everything editors can, plus members, API keys, publishing destinations, integrations, settings, autopilot, limits and billing
Editor	Create and revise content, answer questions, plan with the strategist, approve, publish and update the documents
Viewer	Read everything and comment. Can’t create, approve or publish

Viewers never see approve, publish, revise or new-generation controls, and Wavefront refuses those actions for them even outside the app. The Team page lists everyone’s role and what each role can do.

A workspace always has at least one owner. The last owner can’t be demoted, removed or leave until someone else is an owner.

What only a person in the web app can do

These actions need someone signed in to the web app. API keys never get them, and neither do AI agents:

Approve a version (owners and editors).
Withdraw a published post, or mark one withdrawn (owners).
Turn autopilot’s auto-approve or auto-revise on or off (owners).
Change suggestion messages and auto-apply (owners).
Post or schedule to a social network, and email a newsletter while publishing.
Manage the team and API keys, change limits and rename the workspace (owners).
Connect accounts that need a sign-in: Google, Bing, Slack, Asana, Trello, Google Drive, Notion, Confluence and destination sign-ins (owners).
Billing: choose a plan, buy credits, open the billing portal (owners).
Your calendar feed URL, and creating or leaving a workspace, changing your name, signing out other browsers, and answering invitations.

How agents and keys fit in

An AI agent connected over MCP acts as the person who connected it, with that person’s role, in the workspaces they belong to. A viewer’s agent can only read. See connect an AI agent.
An API key belongs to one workspace and acts for the workspace, limited by the scopes an owner gave it. See API keys and webhooks.

Changing a member’s role changes what their agent can do right away.

Change someone’s role

On Team, an owner picks a new role next to the member. Wavefront asks before changing an owner’s role, and says which API keys will be revoked: demoting an owner revokes the keys they created.

If something goes wrong

You signed in but see “No workspace here yet”. Your account isn’t a member of any workspace. Ask an owner to invite you, or set up your own workspace.
A page says “Workspace not found”. You’re not a member of that workspace, or you were removed. The app checks again when you return to the tab.
The app shows “Couldn’t reach Wavefront”. Your connection dropped. Choose Retry.
The code is refused. It may have expired after 5 minutes or been used. Request a new one. Ten failed codes in an hour lock the address for an hour.