Workspaces
Channels, membership, and what lives in a workspace's settings.
A workspace is one business unit's slice of Coachbot. Each workspace owns:
- Its own public form URL (
/forms/<slug>) - Its own integration credentials (Twilio, Cal.com, OpenAI, Vapi — all encrypted at rest per workspace)
- Its own agent persona (name, role, qualification questions, tone)
- Its own leads, transcripts, bookings, analytics
- Its own teammates (owner / admin / agent roles)
- Its own API keys for the Public API
Workspaces are strictly isolated. The membership gate on /admin/<slug>/... 404s anyone who isn't a member, and every workspace-scoped query filters by workspace_id. A leaked API key from Workspace A can never read Workspace B's data.
Channel
A workspace is created on one channel and can never switch. Two options:
- WhatsApp — Coachbot sends and receives WhatsApp messages via your Twilio account. Inbound replies trigger the agent.
- Voice — Coachbot dials leads via your Vapi account. The Vapi assistant handles the conversation live and calls back into Coachbot mid-call to update the lead, list slots, book a consultation, etc.
To run both, create two workspaces — one for each channel. They can share the same business name, just on different slugs (e.g. acme-whatsapp and acme-voice).
Settings page (/admin/<slug>/settings)
Top-to-bottom:
- Agent status — kill switch. When paused, leads still arrive via the form (or Public API) and are saved, but no outbound messages or calls go out.
- Rename workspace — display name + slug. Changing the slug invalidates the old
/forms/<old-slug>URL. - Public form URL — copy-share helper + the workspace's UUID for support requests.
- Integrations — encrypted credential cards: Twilio (WhatsApp only), Vapi (voice only), Cal.com, OpenAI. See Integrations.
- Data retention — GDPR auto-deletion. A nightly cron at 03:00 UTC deletes leads + transcripts older than the configured number of days. "Forever" disables the sweep.
- API keys — generate keys to submit leads via the Public API. One key per environment.
- Twilio sandbox webhook (WhatsApp only) — copyable URL to paste into Twilio's sandbox so inbound replies reach Coachbot.
- Authentication — diagnostic readout of
AUTH_SECRET+INTEGRATIONS_ENCRYPTION_KEYpresence. Platform-level — operators don't change these. - Danger zone — irreversible Delete workspace button. Owner-only on both client and server. Wipes leads, transcripts, integration credentials, and membership.
Roles
Set on the workspace_members row.
| Role | Can do | Can't do |
|---|---|---|
| owner | Everything. Including renaming and deleting. | — |
| admin | Everything except delete + ownership transfer. | Delete the workspace. |
| agent | Read leads + send manual replies during human takeover. | Touch Settings, integrations, or generate API keys. |
The first user (whoever created the workspace) is automatically the owner.