Access
Share a ThemeForge project with team members, clients, or partners — without sharing your password. The "Access" tab on each project lets you invite people, assign roles, and revoke access at any time.
When to use this
- Agency → client: your client gets visibility and the ability to update their own theme, without touching your account.
- Small team: 2–3 people collaborate on the same WordPress site without rotating a shared password.
- Handover: pass ownership of a project to a new account without re-generating the theme.
Roles
Every project starts with one owner (Parent). The Parent can invite Admins and Members; Admins can invite further Members; Members work on the project but don't manage access.
Parent
The original project creator. Cannot be removed from the group. Has full control over members and access settings.
Admin
Full access to the project. Can invite new members, remove other members (except Parent), and manage roles.
Member
Full access to the project (generate theme, configure pages, deploy). Cannot invite new members or remove others.
How to invite someone
- Open the project page, switch to the "Access" tab.
- Click "Generate invite code". A one-time tf-link: code is created — the first person to accept it joins your group.
- Copy the code and send it to your collaborator via any channel (messenger, email, Slack). It is single-use, so it is harmless once consumed.
- They open the "Access" tab in their own project, paste the code, and click "Join". They appear in the group within seconds.
Invite codes are HMAC-signed and single-use. They expire 3 days after generation — just create a fresh one if needed.
Leaving the group / removing someone
A Member or Admin can leave the group at any time from the Access tab. Once they leave, they lose access to the project (theme generation, project settings).
A Parent or Admin can remove other members from the group. The removed person loses access immediately. The Parent cannot be removed — only the Parent can delete the group entirely (by deleting the project).
Security
- The project's internal update token is never displayed in the UI. It is shared between group members via the database, not the URL.
- Invite codes are HMAC-signed with a server-side secret. Tampered or expired codes are rejected.
- All group members can see each other's emails on the Access tab — by design, so it's clear who has access.
- The Parent role is locked to the project's original creator. Promoting a Member to Parent is not currently supported.
FAQ
Can a Member purchase a subscription for the group?
Subscriptions are per-account, not per-project. Each account in the group needs its own active subscription to use paid features on shared projects.
What happens to the project if the Parent deletes their account?
If the Parent deletes their project, the group is disbanded and every member receives a fresh token. If a Member or Admin leaves, the group simply continues without them.
Can one project be in several groups at once?
No — one project belongs to one group at a time. Joining another group leaves the current one first (the UI asks you to confirm). For two different sites, use two projects.