Skip to content
supastack
Browse documentation
MobileExpo

For AI agents: fetch the complete documentation index at /llms.txt, the full documentation corpus at /llms-full.txt, the agent skill at /skill.md, or this page as Markdown at /docs/mobile/workspaces.md (or send Accept: text/markdown).

Workspaces and members

Switch workspaces, manage the organization, and handle invitations.

Ask about this guide
Open in

Resolve the active workspace

GET /api/workspaces returns the member's workspace memberships and the active workspace id; POST with a workspace id switches. The server resolves context from the selection cookie to the stored preference to the personal workspace and verifies live membership, so a forged or stale selection cannot read another workspace.

Manage the organization

GET /api/mobile/organization returns members, pending invitations, seat usage, and the caller's capabilities — canManage and canLeave; a personal workspace answers notOrganization instead. POST creates an organization, PATCH renames it (owner only), and DELETE removes it (owner only, confirmed by typing the name).

Organization screens live under Settings → Members and Settings → General; the member's own display name edits go through the Better Auth profile route and accept one to one hundred characters.

Invite and accept

POST /api/mobile/invitations emails an invitation with role admin, member, or guest — owner and admin only. Typed failures cover alreadyMember, alreadyInvited, seatLimitExceeded, dailySendLimit, and invalidInput, so the interface can explain each refusal. Resend and revoke live on the invitation id routes, and resend is rate-limited.

Acceptance arrives through the <scheme>://invite/<token> deep link: the app posts the token to the invitations accept route, which returns the workspace id, activates that workspace, and records the preference server-side. Errors cover expired, emailMismatch, not-pending, and seat-limit-exceeded.

Change roles and remove members

PATCH /api/mobile/members/:userId assigns owner, admin, member, or guest; DELETE removes a member; POST /api/mobile/members/leave leaves voluntarily. The sole owner cannot leave or be demoted, members cannot remove themselves through the admin route, and a role change that alters nothing is rejected rather than recorded.

Verification and troubleshooting

Test seat limits, a revoked invitation link, a guest role's reduced actions, and switching back to the personal workspace. A removed member's cached selection must fail closed on the next request, not keep reading the old workspace.

Frequently asked questions

14 questions

What is supastack?

supastack is a modular foundation for building AI-powered SaaS products. It brings together common infrastructure so you can focus on product-specific features.

Does it support web and mobile?

Yes. supastack includes Next.js and Expo apps as starting points for web and mobile experiences.

What authentication is included?

Better Auth covers email OTP, magic-link, and social sign-in; email/password stays available at the API layer and through the Auth.js credentials engine for products that need it. Personal workspaces are provisioned with the account so product records stay scoped from day one.

How does it support AI?

supastack includes configurable multi-provider AI, usage tracking, budgets, and encrypted bring-your-own-key support.

How are subscriptions handled?

For products built on the kit, Stripe billing, subscriptions, and entitlements form the paid-access foundation. Provider secrets stay server-only.

Where does my product-specific code live?

Product-specific features remain in a separate codebase while the product configures and integrates supastack’s foundation modules.

How does supastack pricing work?

The kit is a one-time purchase with lifetime updates: Single Stack at $249 — your pick of Next.js (Web), Expo (iOS & Android), or Tauri (macOS & Windows Desktop) — Dual Stack at $398 with any two repos, or the Full Bundle at $399 with all three repos and the full monorepo, plus $75 per extra developer seat. No kit subscription. Checkout on this site delivers your license key by email, with repository access via GitHub invite.

How do workspaces scope my data?

User-owned records are scoped by workspaceId. Identity, entitlements, AI usage, billing events, and audit entries stay inside the personal workspace boundary.

How do background jobs work?

Trigger.dev is the explicit job runtime. The JobRunner contract only promises enqueue, status, and cancel—workflow semantics stay Trigger.dev-specific and explicit.

How is email different from outreach?

Transactional email covers product workflows such as completion notices. Cold outreach and campaigns are product concerns outside this kit’s email module.

How do mobile purchases work?

Mobile includes native purchases and restore through RevenueCat, with access verified by your server. Configure the store accounts and complete device testing before release. Web billing remains separate.

Where do AI provider keys live?

Bring-your-own-key credentials are encrypted and stay server-only. Keys are redacted from logs; usage and budgets remain visible at the workspace level.

Which payment methods does checkout accept?

The Stripe-hosted checkout accepts cards and can also offer Alipay and WeChat Pay once those wallets are enabled on the Stripe account — handy for buyers in China. Wallet authorizations confirm asynchronously, so the license page updates as soon as the payment clears.

Can I get a refund?

After you've got access to the repository, supastack is yours forever, so it cannot be refunded. But rest assured, you get the complete source code with lifetime updates to build and ship unlimited products for yourself or clients. You just cannot resell the code or redistribute the repository as a starter kit or template.

EN
Theme