# Signing in, roles and what only people can do

> Sign in with an emailed code or Google. Each workspace member is an owner, editor or viewer, and some actions always need a person in the web app.

Source: https://wavefront.adwave.com/help/account-and-team/sign-in-and-roles (updated 2026-10-14)

You sign in to Wavefront with a code sent to your email or with your Google account. In each workspace you're an owner, an editor or a viewer, and your role decides what you can do there. A few actions always need a person signed in to the web app, whatever an agent or API key is allowed.

## Sign in

- **Email code.** Enter your email and choose **Email me a code**. Enter the 6-digit code and choose **Sign in**. A code lasts 5 minutes and works once. You can ask for a new one after 30 seconds with **Send a new code**, or choose **Use a different email**.
- **Google.** Choose **Continue with Google**.

Signing in for the first time creates your account. There's no password to remember or reset.

A browser stays signed in for 14 days. To sign out of every other browser, open **Account** (in the menu at the bottom of the sidebar) and choose **Sign out other sessions**. The browser you're using stays signed in.

## Your account page

**Account** holds your pending invitations, your **Display name** (shown on your work, reviews and comments), the theme (system, light or dark), the workspaces you belong to, and your sessions.

## The three roles

| Role | What it can do |
| --- | --- |
| **Owner** | Everything editors can, plus members, API keys, publishing destinations, integrations, settings, autopilot, limits and billing |
| **Editor** | Create and revise content, answer questions, plan with the strategist, approve, publish and update the documents |
| **Viewer** | Read everything and comment. Can't create, approve or publish |

Viewers never see approve, publish, revise or new-generation controls, and Wavefront refuses those actions for them even outside the app. The **Team** page lists everyone's role and what each role can do.

A workspace always has at least one owner. The last owner can't be demoted, removed or leave until someone else is an owner.

## What only a person in the web app can do

These actions need someone signed in to the web app. API keys never get them, and neither do AI agents:

- **Approve a version** (owners and editors).
- **Withdraw a published post**, or mark one withdrawn (owners).
- **Turn autopilot's auto-approve or auto-revise on or off** (owners).
- **Change suggestion messages and auto-apply** (owners).
- **Post or schedule to a social network**, and **email a newsletter** while publishing.
- **Manage the team and API keys**, change limits and rename the workspace (owners).
- **Connect accounts** that need a sign-in: Google, Bing, Slack, Asana, Trello, Google Drive, Notion, Confluence and destination sign-ins (owners).
- **Billing**: choose a plan, buy credits, open the billing portal (owners).
- **Your calendar feed URL**, and creating or leaving a workspace, changing your name, signing out other browsers, and answering invitations.

## How agents and keys fit in

- **An AI agent connected over MCP** acts as the person who connected it, with that person's role, in the workspaces they belong to. A viewer's agent can only read. See [connect an AI agent](/help/agents-and-api/connect-an-ai-agent).
- **An API key** belongs to one workspace and acts for the workspace, limited by the scopes an owner gave it. See [API keys and webhooks](/help/agents-and-api/api-keys-and-webhooks).

Changing a member's role changes what their agent can do right away.

## Change someone's role

On **Team**, an owner picks a new role next to the member. Wavefront asks before changing an owner's role, and says which API keys will be revoked: demoting an owner revokes the keys they created.

## If something goes wrong

- **You signed in but see "No workspace here yet".** Your account isn't a member of any workspace. Ask an owner to invite you, or set up your own workspace.
- **A page says "Workspace not found".** You're not a member of that workspace, or you were removed. The app checks again when you return to the tab.
- **The app shows "Couldn't reach Wavefront".** Your connection dropped. Choose **Retry**.
- **The code is refused.** It may have expired after 5 minutes or been used. Request a new one. Ten failed codes in an hour lock the address for an hour.

---

Wavefront by Adwave. https://wavefront.adwave.com/