Share the database, not the master key.
Invite another OnDemandDB user to one database. Their role follows them across hosted MCP, REST, SDK, CLI, and the account center—and can be changed or revoked without moving ownership.
Fixed capabilities
Four roles. No ambiguous custom policy.
Client code never decides its own authority. OnDemandDB resolves the current membership for each request, signs it into the origin envelope, and uses separate PostgreSQL roles or SQLite connection/authorizer policy for the final boundary.
| Role | Scope | Context | Schema | Data writes | Access |
|---|---|---|---|---|---|
| Owner | Everything | Yes | Yes | Yes | Yes |
| Architect | Shared | Yes | Yes | Yes | No |
| Writer | Shared | Read | No | Yes | No |
| Reader | Shared | Read | No | No | No |
1Owner creates a one-time linkThe secret stays in the URL fragment.
→2Collaborator signs in to acceptA fresh account can be created while public signup is closed.
→3Role is enforced per requestRevocation fences active work and applies to the next request.
Ownership stays simple.
The owner’s account retains quota, billing, and destructive control. Collaborators can leave. Owners can change roles, revoke pending links, or remove a member. API keys never inherit a human collaborator’s membership.