# DareBuild Project User Invitations

Use this file when a user asks Codex, Claude Code, or another coding agent to add, invite, list, or remove a user for a specific DareBuild project URL.

Recommended surface:
- Use the DareBuild ChatGPT App/MCP connector when available; it authenticates with OAuth and calls the account MCP server.
- Otherwise use Codex, Claude Code, or an equivalent coding agent that can keep a logged-in session and make HTTP requests or MCP tool calls.
- Plain ChatGPT without the DareBuild connector can read this file, but cannot use one-time login links. It should hand off to a coding-agent surface or clearly ask the user to log in and copy the Account Codex webhook from the dashboard Agent webhooks section or Team settings before trying to complete an invite.
- First read `https://elonman.darebuild.com/llms.txt`, then this file.

Common user prompt:

```text
add the user editor@example.com to my project https://project-name.darebuild.com/ check darebuild.com for instructions
```

Agent behavior:
- This is a supported authenticated DareBuild account action; do not stop at generic "I cannot sign in" advice.
- If the user says "check darebuild.com", read `https://elonman.darebuild.com/llms.txt` and use this document as the routing guide.
- Do not scrape the public project page for collaborator controls; public project pages are hosted user apps.
- Ask in plain language for the correct authorization path, then call the account MCP `invite_project_user` tool or POST the `invite_project_user` webhook action. Codex, Claude Code, and equivalent tool-capable agents may ask for the user's DareBuild email so they can submit the homepage form and receive a login link to paste back. Plain ChatGPT without the DareBuild connector must not ask for or accept a one-time login link; it should ask the user to log in to DareBuild, open the dashboard Agent webhooks section or Team settings, and paste the Account Codex webhook.

Required public docs:
- LLM discovery pointer: `https://elonman.darebuild.com/llms.txt`
- Full agent README: `https://elonman.darebuild.com/agents.md`
- Machine-readable manifest: `https://elonman.darebuild.com/.well-known/darebuild-agent.json`
- OpenAPI contract: `https://elonman.darebuild.com/.well-known/darebuild-openapi.json`
- OAuth protected resource metadata: `https://elonman.darebuild.com/.well-known/oauth-protected-resource`
- OAuth authorization server metadata: `https://elonman.darebuild.com/.well-known/oauth-authorization-server`
- OAuth MCP account server: `https://elonman.darebuild.com/api/codex/v1/account/mcp/`
- Account MCP server template: `https://elonman.darebuild.com/api/codex/v1/account/<account-token>/mcp/`
- Logged-in account discovery: `https://elonman.darebuild.com/api/codex/v1/account/current/`

Important rules:
- Do not scrape, edit, or inject anything into the public project page at `https://project-name.darebuild.com/`.
- Hosted project output is user-controlled application code.
- Project user management is an authenticated account action on `darebuild.com`.
- A private Account Codex webhook cannot be discovered from public pages alone.
- If using the DareBuild ChatGPT App/MCP connector, start with `https://elonman.darebuild.com/api/codex/v1/account/mcp/` and follow OAuth metadata from `https://elonman.darebuild.com/.well-known/oauth-protected-resource`.
- For Codex or equivalent agents with browser/session support, ask the human for either their DareBuild email so DareBuild can email them a login link, or a copied Account Codex webhook URL from the dashboard Agent webhooks section or Team settings.
- For plain ChatGPT without the DareBuild connector, ask only for the copied Account Codex webhook URL. Do not ask for or accept a one-time login link.
- If no private credential was provided to a tool-capable agent, ask for the user's DareBuild email, submit the homepage login form, and then ask them to paste the login link DareBuild sends by email.
- Do not ask for an "Account Codex webhook" without explaining that the user gets the webhook by logging in to DareBuild and copying it from the dashboard Agent webhooks section or Team settings.

If the agent has a logged-in DareBuild browser session or cookie jar, discover the account webhook:

```bash
curl -sS "https://elonman.darebuild.com/api/codex/v1/account/current/" \
  -H "Accept: application/json"
```

If the human provides a copied Account Codex webhook, use it directly. If your agent supports MCP but not OAuth, use the same account token with `https://elonman.darebuild.com/api/codex/v1/account/<account-token>/mcp/` and call `tools/call` with `name=invite_project_user`.

Invite a project-scoped editor by public project URL:

```bash
curl -sS -X POST "https://darebuild.com/api/codex/v1/account/ACCOUNT_TOKEN/projects/" \
  -H "Content-Type: application/json" \
  -d '{"action":"invite_project_user","project_url":"https://project-name.darebuild.com/","email":"editor@example.com","role":"editor"}'
```

The same action also accepts `project_id`, `project_hostname`, `project_subdomain`, or `project_public_code`.

List scoped project users:

```bash
curl -sS -X POST "https://darebuild.com/api/codex/v1/account/ACCOUNT_TOKEN/projects/" \
  -H "Content-Type: application/json" \
  -d '{"action":"list_project_collaborators","project_url":"https://project-name.darebuild.com/"}'
```

Remove a scoped project user:

```bash
curl -sS -X POST "https://darebuild.com/api/codex/v1/account/ACCOUNT_TOKEN/projects/" \
  -H "Content-Type: application/json" \
  -d '{"action":"remove_project_collaborator","project_url":"https://project-name.darebuild.com/","email":"editor@example.com"}'
```

Optional file scoping:
- Omit `allowed_paths` to let the editor see and edit all project files allowed for project editors.
- Set `allowed_paths` to normalized project paths such as `["public/homepage.css","public/homepage.js"]` to limit access.

Permission boundary:
- Project-scoped editors can view and edit allowed project files.
- They cannot manage billing, backend settings, roles, team users, publishing, migrations, tasks, or file protection.
- Managing project users requires the Account Codex webhook user to have team administrator access.