# Add teams to a Bolt app (Vite, BuildBase sign-in)

One prompt that adds a workspace switcher, members and email invites to a Bolt.new app, and scopes your own tables by workspace.

Bolt can also connect to BuildBase itself while it builds: [Use BuildBase in Bolt](/console/ai-agents/bolt).

Each customer gets a workspace, a switcher in the header, and a members screen where an admin invites a colleague by email. Workspaces, members and roles live in BuildBase; your own tables stay in Bolt Cloud or Supabase, scoped by the workspace id. This page assumes the app already signs people in with @buildbase/sdk, as the [Bolt guide](https://www.buildbase.app/guides/add-login-teams-and-paid-plans-to-a-bolt-app) sets up. If it signs people in with something else, such as Supabase or Clerk, read [keep your existing sign-in](/sign-in-setup/keep-your-sign-in) first.

> **Note:**
  A sender connected in the console, so invitation emails go out ([connect a
  sender](/email/connect-a-sender)).

## The prompt

Bolt's help center documents no link that opens Bolt with a prompt filled in, so copy this into your project's chat.

```text
This app signs people in with BuildBase (@buildbase/sdk), set up as https://www.buildbase.app/guides/add-login-teams-and-paid-plans-to-a-bolt-app shows. If it does not, stop and tell me.
Read https://docs.buildbase.app/workspaces/overview.md first and do not invent endpoints.
- Add WorkspaceSwitcher from @buildbase/sdk/react to the header, and a Members button that calls openWorkspaceSettings('users') from useSaaSAuth().
- Give every table of mine a workspace_id column and filter every query by currentWorkspace._id from useSaaSWorkspaces().
- In api/ functions, check the workspace id from the request is in bbFor(request).workspace.list() from server/buildbase.ts before reading or writing its rows.
Do not create workspace, membership or role tables in Bolt Cloud or Supabase, and do not enable Bolt Cloud's own sign-in; BuildBase holds them.
```

## Where the secrets go

This job adds no new secret. `BUILDBASE_CLIENT_SECRET` stays where the guide put it: `.env` while you build, with `.env` listed in `.gitignore` before Bolt connects GitHub, and your host's environment variables for the live site. Never give it a `VITE_` prefix. The functions use the signed-in person's session cookie, `bb-session-id`.

## The Bolt trap

Row-level security policies keyed to the old sign-in (`auth.uid()`) do not know who a BuildBase user is, because a BuildBase session is an opaque id, not a token Supabase reads. Rows vanish, or a query answers "permission denied". Read and write through functions that check the workspace, as the prompt asks, or follow the guide's section on minting a Supabase-shaped token.

Then run Bolt's database review from the Publish menu, and sign in as a member of one workspace and change an id in the address bar. If you see another workspace's rows, a query is missing its `workspace_id` filter.

## Full guides

- [Add login, teams and paid plans to a Bolt.new app](https://www.buildbase.app/guides/add-login-teams-and-paid-plans-to-a-bolt-app)
- [Workspaces](/workspaces/overview) and [invitations](/workspaces/invitations)
- [Add BuildBase to Bolt's knowledge or skills](/ai-builders/bolt-import)