Accounts

Everything in Wallfacer belongs to an account. Environments, tasks, and VMs all live under one account.

What Is an Account

An account is a multi-tenant container. You can belong to multiple accounts, such as a personal one, a team, or an organization. Every resource lives under exactly one account.

When you sign up with an invite code, using an email and password or Google (see Signing In), you get a personal account. You can create additional accounts or be invited to existing ones. If you already belong to an active account, an account you create is active immediately, so you can use it without returning to the waiting room. If you do not belong to an active account, the new account awaits activation. This includes members of paused or rejected accounts.

The account home is the dashboard: who on your AI team delivers, what they cost, and where a human still steps in.

Sign Up and Set a Password

New users need an invite code, a referral code, or a member invitation. On web, iOS, and Android, enter a code before your email and other details, then continue with email and password or Google. On iPhone and iPad, you can also choose Continue with Apple on the welcome, log-in, or sign-up screen and complete Apple's sign-in sheet. Checking a code does not use it up; creating a user does.

If an account member invited you by email, open the invitation link instead. Sign up with the invited email address, then accept the invitation to join their account. Existing users can sign in without a code. If you do not yet have a Wallfacer user, signing in with Google or Apple still requires a code or invitation to create one.

If the invitation shows that you are signed in with a different email address, choose Log out on that screen. The invitation stays open and offers Log in and Create account. Use the invited email address; after signing in or signing up, you return to the invitation to accept it. Back to Wallfacer leaves the invitation without accepting it.

Apple email choice. If you choose Hide My Email, Apple gives Wallfacer a private relay address. That address will not match a Wallfacer user registered under your personal email, so you may be asked to sign up instead of signing in to that user. Use the same Apple account on later sign-ins. Continue with Apple appears only in the iOS app; use email and password or Google on Android, web, and desktop.

On web signup, select I don't have an invite code to open a process inquiry form. It asks for your name, email, and a message; company is optional. An email already entered on signup carries over. The inquiry does not create an account or bypass the invite code requirement. Submission from the web signup form is temporarily unavailable; use the website contact form to send your inquiry.

If an invitation link is malformed, signup opens the invite code step so you can enter a valid code. If registration or Google sign-in refuses an invitation, signup returns to that step with the invited email address filled in, even if the invitation has expired. Enter a valid code to continue signup with that address.

A new Google signup is already email-verified and receives one welcome email. An email signup receives its welcome email after verification. Verification confirms the email address; it does not activate a new account. The account stays pending until the Wallfacer team activates it. Open the app to view the waiting room and any available setup steps. If you signed up with Google, use Set a password to add one; if you forgot a password, request a reset code. Password-code requests allow five per minute for each email address and client IP pair, plus 100 per minute across all addresses at one IP. The per-address limit ignores letter case and surrounding spaces.

Delete Your Account

Delete your Wallfacer user under Settings > Profile > Delete account. If you signed in with Apple, Wallfacer also asks Apple to revoke its sign-in access before removing your Apple identity, when Apple token revocation is configured. A failure to contact Apple does not block account deletion.

Switching Accounts

On the dashboard, use the company switcher to choose an account. The account you choose scopes its agents, computers, and configuration. The dashboard also manages account membership, integrations, API keys, and account settings.

In the native app, task history spans your accounts. Choose All or an account pill to filter the history without leaving the conversation. Press and hold a pill to open Organize accounts, where you can reorder or hide pills for this user on this device. Hiding a pill filters that account's tasks from All until you show it again. Opening a task link uses the task's account for that task's messages and actions. See Tasks.

Account Settings

Open the account on the dashboard to change its name, membership, integrations, keys, and other configuration. The app's account management links open the corresponding dashboard page.

On the dashboard, open Account > Appearance > Theme to choose the palette shared by everyone in the account. Ink & Parchment is the default; Evergreen, Slate & Lilac, and Copper & Cream are also available. Owners and admins can select a palette to preview it across their own dashboard, then choose Save theme to apply it for every member. Discard changes or leaving the page restores the saved palette. Members can see the selected theme but cannot change it.

You can also set the palette through the account API. The shared theme is separate from each person's light or dark mode, which is set on the same Appearance tab.

Model Usage

Account Usage is available to owners and admins under Account. It reports model calls Wallfacer paid for at provider rates before account credits, so the dollar figure measures consumption rather than an invoice. Choose Month, 7 days, 30 days, or 90 days. The view shows cost per day and where it went: AI employees, work people started, platform overhead, and unattributed usage when present. You can inspect the employees, models, and tasks behind the total. Each employee's Performance view shows its own model usage.

Billed elsewhere counts calls and tokens on your own provider keys and subscription seats. Those calls do not add to Wallfacer-paid cost and have no dollar estimate. A cost can also be incomplete when a platform-paid call has no price: a group with only unpriced calls has an unknown cost, while a partly priced group shows only its known cost. Check the coverage notice for missing history, delayed updates, or attribution gaps before treating a total as final.

An operator can set an account monthly spend limit; accounts have no monthly limit by default. Each employee's daily limit applies to Wallfacer-paid calls. Key rotation does not reset either limit. Concurrent calls can pass a limit because production proxy workers track spend separately, so these are soft controls. See Agent Usage for the daily limit.

Team Members

Accounts support multiple users. Invite teammates by email, or attach an existing Wallfacer user directly when they already have an account.

Invite a Teammate

On the dashboard, open the account's Members section and choose Invite. The app's Account link opens that dashboard page. Owners and admins can invite teammates; members can view the list without an invite action.

Enter the teammate's email address and choose a role:

• Member can use the account but cannot manage membership.
• Admin can add, update, and remove members, but cannot grant owner access.
• Owner has full control, including changing ownership. Only an owner can grant this role.

An existing Wallfacer user joins immediately; otherwise, Wallfacer emails an invitation that they accept to join.

Alongside human members, an account has agents -- AI teammates that run your tasks. Tasks are attributed to whoever created them, human or agent.

Membership gives a user access to the account, but not every resource is automatically visible to every member:

• Tasks record a responsible person as their owner. When you start a task, you are its owner. Tasks that an agent opens on their own, such as from a trigger, start with no owner and surface in a shared "needs someone" queue for a teammate to pick up.
• Environments have visibility: private, account_read, or account_edit.
• VMs and sessions are scoped through the task, environment, and account permissions that created them.

Use private environments for personal work, account_read for shared team environments that should stay stable, and account_edit when teammates should be able to change the manifest or regenerate snapshots.

The People Directory

Open Team on the dashboard to see everybody your account knows. That is wider than the member list, and it is a durable record rather than a view over recent activity: once a person is in it, they stay, whether or not you have spoken lately.

A phone call or meeting with no caller name, email, number, or other identity still appears in the agent's Calls, but it does not add an Unknown caller person to Team. An identified caller can appear as a person in the directory.

Three groups share the page:

• Members, the people on your account.
• AI employees, your account's agents.
• Met on a channel, everybody your agents have been in a conversation with. Each row says where they were met.

Open a person to see the whole record.

• Where we have seen them lists every spelling the account has encountered for that person, an email address, a Slack handle, a name. Any of them resolves to the one person, so history written under an old spelling still points at the right record.
• Preferences is what you tell your agents about reaching this person. Preferred channel is App, Slack, Email, or No preference, and an agent tries that channel first, then the channel the work is on. Working with me is a free-text note, for example "Mornings only. Cc her assistant on anything with a date in it."
• Same person? folds a duplicate into this record when the same person arrived twice under spellings the account could not join on its own. Wallfacer joins two rows automatically only on an exact email match. Anything weaker stays two rows until you decide. A merge keeps the surviving record, carries the other one's spellings across, and cannot fold two different account members together.

Your agents read this directory. Asking one to share a document "with Ada" means it looks her up and uses the address the account already holds, rather than asking you for it.

The directory is open to any account member, in the app and through /v1/accounts/{account_id}/people in the API.