People join a team in three steps: an admin invites them, they accept, and an admin confirms them after comparing fingerprints. The fingerprint check is what keeps the server from slipping in keys of its own.
Why fingerprints
Every account has a fingerprint: 32 characters in groups of four, made from the account's public keys. You'll find yours in Teams, under Your fingerprint.
When an admin confirms you, their app seals the team's vault keys to the public keys the server shows them. If those weren't really your keys, the server could read what you share. Comparing fingerprints over a call or in person proves they are yours. The same check, the other way round, proves to you that you're joining the team you think.
1. Invite
Owners and admins invite from the app or from the team page on the website.
In the app
- Open Teams, then Open next to the team.
- Under Invites, enter the person's email address.
- Owners can pick Member or Admin. Only the owner invites admins.
- For a member, tick the vaults they'll get once you confirm them, and the access to each (view, edit or manage).
- Choose Invite.
On the website
On the team page, use Invite someone: the email address, and for owners a role, then Send invite. Vault access is given in the app after confirming.
About invites
- An invite works once, only for that address, for 7 days. A new invite to the same address replaces the old one.
- morphgate.com emails the invite. A server that doesn't send email, such as the reference server, shows the invite code to pass on yourself.
- If the team only allows certain email domains, invites to other addresses are refused. See Team policies.
- Pending invites are listed with their expiry date. Cancel withdraws one.
2. Accept
The invited person needs a sync account with the invited address, on the team's server. If they don't have one yet, they turn sync on with that address first (see How sync works).
- Open the link in the invite email. The page shows the invite code.
- In MorphGate, open Teams. Under Join with an invite, paste the code and choose Look up.
- MorphGate shows the team's name, the invited address, the role and who sent it, with the owner's fingerprint.
- Ask the owner, or whoever invited you, to read you the owner's fingerprint. Join only if it matches. Tick It matches the fingerprint they read to me and choose Join followed by the team's name.
You're now Waiting for an admin to confirm you. The team page in the app shows your fingerprint, ready to read out. You can still Leave.
3. Confirm
- In the team's member list, people who accepted show Waiting for confirmation and a Confirm… button.
- Choose Confirm…. Ask the person to read you their fingerprint (Teams, on their device), on a call or in person.
- If it matches the one shown, tick It matches what they read to me and choose Confirm followed by their address.
Your app signs a certificate for their keys and seals the vault keys to them. Confirming gives them the vault access their invite offered. Their vaults arrive on their devices at the next sync. Only the owner confirms admins.
On a paid plan, confirming needs a free seat. If every seat is taken, add seats first. See Plans and billing.
In the member list
Each member shows their email, role, fingerprint, and whether your device has verified their keys (Keys verified or Keys not verified yet). Confirmed members also show how many SSH keys they've published to the team (see Removing members and rotating keys).
The owner can Make admin or Make member. Admins open every vault and manage members. Someone made a member again keeps only the vault access you give them, and vaults they could only open as an admin get a key rotation.
Whom the app trusts
The app doesn't take the server's word for anyone's keys. It trusts the owner because the first owner is pinned when you join and each later owner is signed by the one before. It trusts admins certified by an owner, and members certified by an owner or admin. Each key it has verified is pinned, so a different key for a known person is a hard error, not a question.
Members provisioned by your identity provider
On the Business plan, your identity provider can invite and remove people over SCIM. An admin still confirms new members in the app. See SCIM provisioning.