Workspaces

Scope and ownership

A workspace groups sites, agents, departments, conversations, subscriptions and integrations. A business may operate more than one workspace. A resource ID alone does not authorize access; the server checks the authenticated workspace and the caller’s permissions.

Isolation depends on authorization and data-access checks. No software architecture makes data leakage impossible; integrations must still validate scope and protect credentials.

Workspace authentication

Agent-session JWTs contain workspaceId and agentId, not a wid claim. Product API keys and MCP authorizations have their own scopes. A Verify key cannot be substituted for an agent session when reading Inbox reports.

Cross-workspace and unavailable resources generally return a not-found or forbidden response, according to the endpoint. Never infer access from knowledge of another workspace’s IDs.

Sites and public identifiers

Sites belong to a workspace and have widget configuration. The public installation snippet contains a site embed identifier, not an administrator credential. The domain must be allowed for that site. Multiple sites can share a workspace without sharing every setting.

Create and manage

Signup creates a workspace and its first administrator. Invite teammates and assign product, department and channel access from the dashboard. Use the Workspaces reference for metadata updates and the separate owner-authorized deletion flow.

Build integrations

Use the documented API for the product you need. Store each customer’s authorization separately. Message.com does not offer a universal third-party OAuth app-registration flow for arbitrary dashboard routes; the MCP authorization and individual provider connectors have dedicated flows.