Administer

Organizations

What an organization owns#

An organization, or organization, is your team's shared account on Valet. The organization owns everything published to it: skills, artifacts, apps and agents, and the connectors, resources, channels and env vars they use. Every member can see, change and remove all of it.

When someone leaves, what they built keeps running. The dashboard lists each artifact, app and agent with the person who published it, but that person doesn't own it.

Names and addresses#

The organization's name is part of every address it serves:

https://<name>.<org>.valet.run

A name is 3 to 63 lowercase letters, digits and hyphens, and starts and ends with a letter or digit. Some names, such as admin, api and www, are reserved. An organization can't be renamed.

More than one organization#

A person can belong to several organizations. Create one in the dashboard or with valet orgs create <name>. list_orgs, or valet orgs, lists yours.

MCP tools act on the organization named by org_name, or else the organization you joined first. CLI commands act on the organization named by --org, then the organization linked to the current folder, then your default organization. Set the default with valet orgs set-default <org>.

Members and invitations#

Every member of an organization has the same access. There are no roles: no owner, no administrator, no read-only member. Any member can publish, change access, invite and remove members, replace the organization's governance skills, and delete the organization.

Invite and join#

Invite people from the dashboard's Team page, or:

Valet emails the person a link and a code, such as ABC-123. An invitation lasts 7 days and works once. The Team page also shows each pending invitation's link, to send another way if the email doesn't arrive.

The code isn't tied to the address it was sent to: whoever holds it can join. Revoke an invitation you no longer want:

To join, open the link or run valet orgs join ABC-123. Someone who signs up with the invited address also sees the invitation during onboarding. valet orgs members acme lists members and pending invitations.

Leave or remove#

You can't remove yourself; leave instead. The last member can't leave until they add another member or delete the organization.

Removing a member ends their access to the organization, including its private artifacts and apps, at their next request: Valet checks membership on every request. What they published stays.

Sign-in#

People sign in to Valet with an email and password or a Google account. One sign-in covers the dashboard, the CLI (valet auth login), MCP clients such as claude.ai, and every private artifact and app in their organizations.

Signing in doesn't add anyone to an organization. Membership comes only from an invitation, or from creating the organization.

Valet has no per-organization connection to your company's identity provider: no SAML or OIDC sign-in setting and no SCIM provisioning. Your directory doesn't add or remove Valet members, so remove people from the organization when they leave the company.

Who can reach what's published#

• Private admits organization members. Password adds anyone with the password. Public admits anyone.
• New artifacts and apps start private.
• Valet checks access before an artifact or app sees the request. An app learns nothing about who the visitor is.
• An agent has no page; its channels decide who reaches it. On Slack, anyone who can message the agent there reaches it. An MCP channel with sign-in admits organization members. A webhook, or an MCP channel's token, admits whoever holds the secret.

Logs and visibility#

The dashboard lists every artifact, app and agent in the organization, with who published each. The MCP tool list_services returns the same list with each one's access mode. The organization's skills are under Integrations, and list_skills returns them; Valet doesn't record who published a skill.

get_logs returns an app's or agent's recent log lines, and valet logs -f follows them. Valet keeps only recent lines, 72 hours by default.

A drain sends an artifact's, app's or agent's logs to your own system over OTLP HTTP:

• A drain belongs to one artifact, app or agent. There is no organization-wide drain.
• Valet stores header values encrypted.
• For an artifact or app, the drain also receives one access event per request: method, path, host, status, duration, response size, and a failure code when Valet hit an error. Access events don't record who made the request.
• Delivery is best effort: Valet drops a batch an endpoint keeps refusing.

Valet has no audit log. It doesn't record which member changed an access mode, edited a skill, or invited or removed someone.

Delete an organization#

Any member can delete an organization. The dashboard has no delete button; use the CLI. Destroy what the organization owns first: its agents, apps and artifacts, then the connectors and resources they held. Then run:

The organization, its members and its invitations are gone, with no undo.