Understand authentication and workspace isolation
Wirevox uses Supabase Auth for user authentication. Protected backend routes require a valid bearer token, resolve the caller's workspace membership, and then check the permission required for the resource.
Authentication and authorization are separate
- Authentication establishes the signed-in user.
- Workspace membership establishes which tenant the user can enter.
- Role permissions determine which operations the user may perform there.
- Resource checks resolve an agent, number, knowledge base, or function to its workspace before authorizing access.
A resource ID is not authorization. Backend routes must still verify the active user and owning workspace.
Current roles
| Role | Security-relevant access summary |
|---|---|
| Owner | Full workspace administration, billing, resources, integrations, and users. |
| Admin | Broad operational management without standard workspace billing permission. |
| Member | Agent and call access, with more limited knowledge, integration, number, and user administration. |
| Viewer | Read access to workspace and calls; no agent-management permission. |
Agency owners and admins can open subaccount dashboards through the parent relationship and receive administrative subaccount access. Treat parent-agency membership as privileged access to child workspaces.
See Roles and permissions for the exact current matrix.
Tenant scope
Agents, calls, leads, knowledge bases, integrations, functions, numbers, Chat records, Vox records, and billing usage are associated with a workspace. Authenticated routes use explicit workspace checks or resolve the workspace through the target resource.
The backend uses a privileged database service connection for many operations, so correct route authorization and workspace filters are essential controls. Do not bypass backend routes with direct database access.
Invitations and membership
Workspace invitation tokens are stored as hashes, expire after seven days, and are bound to the invited email. Acceptance requires an authenticated user with a confirmed matching email. Revoke pending invitations that are no longer needed.
Removing a member or leaving a workspace removes future membership access; it does not delete resources or historical records created while that user had access.
Public and guest access
Some surfaces intentionally operate without a Wirevox login:
- shared voice-test URLs contain a high-entropy bearer token, limits, and a frozen agent snapshot;
- Beta Website Chat uses an allowed-origin check, a signed short-lived bootstrap token, and a hashed session token; and
- OAuth callback routes receive provider redirects.
Treat shared URLs and session tokens as credentials. Do not place them in tickets, analytics, screenshots, or public repositories. Revoke a shared test link if exposed.
Access review checklist
- Review Owners and Admins regularly.
- Remove inactive members and revoke unused invitations.
- Review agency access to every subaccount.
- Give integration management only to roles that need it.
- Use separate test and production workspaces when practical.
- Verify the workspace ID before exporting or deleting data.