Multi-tenant & invites

Tower is invite-only and tenant-isolated by design.

Bootstrap

The first person to register becomes the platform owner — no invite required. Every registration after that needs a valid invite code, or it's rejected.

Invites

Every authenticated member — owner included — can mint invite links from the console. Codes are single-use and can be locked to a specific email. Share the link and the recipient registers against it:

https://wess.dev/admin/register?code=<code>

Anyone you invite can also invite others.

Isolation

• Members see and manage only their own apps, databases, env vars, tokens, and the invites they created.
• The owner sees everything — all apps, all members, tenant databases, AI providers, and the platform events feed.
• App ownership is enforced across the API, the console, and git push — you can't reach another member's app.

Member management

The owner can revoke any invite and remove members (their apps' ownership is released for the owner to reclaim or destroy). Members can revoke only their own pending invites.