Docs / Workspace

Amargi Workspace

Amargi Workspace is the shared identity and launcher layer for the Amargi product family. Every product (Reach, Agents, Escalate, Mail, Meet, Remote) uses Workspace to authenticate users, issue tokens, and open in one click.

Last updated: 2026-05-17

Overview

Amargi Workspace is the shared identity and launcher layer for the Amargi product family. Every product (Reach, Agents, Escalate, Mail, Meet, Remote) uses Workspace for:

Authenticating users (email and password, optional 2FA).
Issuing JWTs that each product consumes.
Managing organization membership and roles.
Providing the launcher that opens each product in one click.

Workspace stores ONLY identity data (email, password hash, 2FA, sessions, organization membership). It does NOT store any product data (WhatsApp messages, tickets, agent runs, all of that lives in each product's own database with tenant isolation enforced).

Quickstart

1Sign up at signin.amargicreative.com and verify your email.
2Create a workspace (auto-created on first sign-up; pick the business name).
3Invite teammates from Settings then Team. Each gets a direct invite link.
4Open the launcher at app.amargicreative.com to access your connected products.
5Enable 2FA from Settings then Security. Required for accounts using Meta products (Reach, Escalate).

Key concepts

User, Workspace, Organization

A User is an individual account, identified by email. An Organization is the legal and billing entity, usually your company. A Workspace is an operational container inside an organization, most customers have one workspace per organization; larger teams may use several (per branch, brand, etc.). Resources (WABAs, agents, tickets) belong to a workspace, not directly to an organization.

Roles

Roles are workspace-scoped, the same user can be Admin in one workspace and Viewer in another. Product-specific roles (e.g. a Reach agent that can send) exist per product, see the product docs for each.

Owner: Full control (billing, suspension, deletion).
Admin: Product configuration, team management, no billing.
Member: Day-to-day operational user (sending messages, opening tickets).
Viewer: Read-only access, useful for external auditors.

JWT and JWKS

Workspace issues JWTs signed with RS256. The public key is available at the standard JWKS endpoint at https://signin.amargicreative.com/.well-known/jwks.json. Every Amargi product (and any external integration you write) must verify token signatures against the JWKS before accepting the request. JWT claims include:

sub: User id (UUID).
org: Active organization id.
workspace: Active workspace id.
role: Workspace-scoped role.
iss: https://signin.amargicreative.com
aud: amargi-platform (shared across products).

Sessions and cookies

Workspace maintains two cookies on the apex domain .amargicreative.com so all subdomain products share the session. The cookies:

amargi_workspace_access: Short-lived JWT (15 minutes) sent on every request.
amargi_workspace_refresh: Long-lived refresh token (30 days) automatically used to renew the access token.

Common tasks

Invite a teammate

Settings then Team then Invite.
Enter email, pick role.
Copy the invite link or let Workspace email it.
The teammate accepts, creates an account, automatically joins the workspace.

Create an API key

Settings then API Keys then New Key.
Give it a descriptive name and pick scopes (read, write).
Copy the token immediately, it will NOT be shown again.
Use it as Authorization: Bearer <key> in your API requests.

Enable 2FA

Settings then Security then Enable 2FA.
Scan the QR code with an authenticator app (Google Authenticator, 1Password, etc.).
Save backup codes somewhere safe.
Confirm by entering a current TOTP code.

Revoke a session

Settings then Sessions shows every active session with IP, browser, and last-seen.
Click Revoke next to any session you do not recognize.
Tokens are invalidated immediately; that session is logged out on its next request.

API reference

Public authentication endpoints

No JWT required to reach them.

POST/api/auth/signupCreate a new account.

POST/api/auth/loginSign in; returns cookies.

POST/api/auth/logoutClear cookies and invalidate refresh token.

POST/api/auth/refreshRefresh access token from refresh token (handled automatically).

GET/.well-known/jwks.jsonPublic JWKS key for verifying JWT signatures.

JWT-protected API endpoints

Need either the amargi_workspace_access cookie or an Authorization Bearer header.

GET/api/meCurrent user profile and organization memberships.

GET/api/organizations/:id/membersList organization members.

POST/api/organizations/:id/invitesInvite a member.

POST/api/api-keysCreate a new API key.

Getting help

Email support at contact@amargicreative.com. For a billing issue or account deletion, see the deletion guide. For our privacy and encryption posture, see the privacy posture page.

contact@amargicreative.com Deletion guide Privacy posture

Related docs

Reach Agents Escalate Widget All docs

Ready to build on Workspace?

Talk to us about identity, SSO, and how Workspace ties your team into every Amargi product. Or request access and we will get you set up.

Talk to us Request access