Accounts and Members

Select the CLI organization and manage invitations through Auth-owned permissions.

Run outside a Lobby agent after lobby login. These commands use the saved CLI session, independently of your browser. Add --site HTTPS_ORIGIN for another environment. Listing and switching never create an account.

lobby accounts list
lobby accounts switch ACCOUNT_ID
lobby auth status
lobby members list
lobby invitations list

accounts list returns accountId and authorized accounts: [{id, name}]. members list returns that account ID, canInvite, canManageRoles, and members: [{id, userId, role, name, email}]. invitations list returns outgoing invitations: [{id, email, role}] and incoming: [{id, name, role}]. Only pending, unexpired invitations are listed. Use member IDs for role changes and invitation IDs for acceptance, cancellation or resend; they are not interchangeable.

lobby members invite teammate@example.com
lobby invitations accept INVITATION_ID
lobby invitations resend INVITATION_ID
lobby invitations cancel INVITATION_ID
lobby members role MEMBER_ID --role admin

Operation	Required authority
List accounts and switch	Signed-in member of the target organization.
List members	Membership in the resolved CLI organization.
Invite, cancel, resend	Current organization owner/admin, subject to the invitation’s role.
Accept	The signed-in email must own that invitation.
Change a member/admin role	Current organization owner; owner roles cannot be changed here.

Invitations always grant member. After joining, an owner can change a member’s role to admin or back to member. Auth enforces permissions and owns delivery, membership, expiration and acceptance. An administrator cannot manage a pending admin invitation through Lobby. Switches check membership before changing the active account.

Switch and acceptance save returned cookie changes in the private local session file while preserving unrelated cookies, then read the selected account again. They return { "ok": true, "action": "switch", "accountId": "..." } or the equivalent accept result. Other mutations return { "ok": true, "action": "..." }. No cookie or invitation email content is printed. These operations do not switch your browser, migrate artifacts, or change a running agent’s authority. Avoid concurrent account switches through the same CLI session.

A lost response or server failure may follow a completed mutation. The CLI never automatically replays it. Inspect the three list commands before retrying. A post-switch verification failure distinguishes the accepted operation from the unverified account selection. HTTP 401 requires checking login; 403 means the current identity/role/account is not permitted; 404 means the target is unavailable. Upstream error details are not printed.

Local MCP’s get_team exposes the metadata read with no input arguments. Mutations use the explicit CLI commands above. CLI/MCP are supported contracts; the underlying product-session routes are internal, rather than a public REST or customer API-key integration.