# Add teams to a Lovable app (TanStack Start, BuildBase sign-in)

One prompt that adds a workspace switcher, members and email invites to a Lovable app, and scopes your own tables by workspace.

Lovable can also connect to BuildBase itself while it builds: [Use BuildBase in Lovable](/console/ai-agents/lovable).

Each customer gets a workspace, a switcher in the header, and a members screen where an admin invites a colleague by email. Workspaces, members and roles live in BuildBase; your own tables stay in Lovable Cloud or Supabase, scoped by the workspace id. This page assumes the app already signs people in with @buildbase/sdk, as the [Lovable guide](https://www.buildbase.app/guides/add-login-teams-and-paid-plans-to-a-lovable-app) sets up. If it signs people in with something else, such as Supabase or Clerk, read [keep your existing sign-in](/sign-in-setup/keep-your-sign-in) first.

> **Note:**
  A sender connected in the console, so invitation emails go out ([connect a
  sender](/email/connect-a-sender)).

## The prompt

[Open in Lovable](https://lovable.dev/#prompt=This%20app%20signs%20people%20in%20with%20BuildBase%20%28%40buildbase%2Fsdk%29%2C%20set%20up%20as%20https%3A%2F%2Fwww.buildbase.app%2Fguides%2Fadd-login-teams-and-paid-plans-to-a-lovable-app%20shows.%20If%20it%20does%20not%2C%20stop%20and%20tell%20me.%0ARead%20https%3A%2F%2Fdocs.buildbase.app%2Fworkspaces%2Foverview.md%20first%20and%20do%20not%20invent%20endpoints.%0A-%20Add%20WorkspaceSwitcher%20from%20%40buildbase%2Fsdk%2Freact%20to%20the%20header%2C%20and%20a%20Members%20button%20that%20calls%20openWorkspaceSettings%28%27users%27%29%20from%20useSaaSAuth%28%29.%0A-%20Give%20every%20table%20of%20mine%20a%20workspace_id%20column%20and%20filter%20every%20query%20by%20currentWorkspace._id%20from%20useSaaSWorkspaces%28%29.%0A-%20In%20TanStack%20Start%20server%20routes%2C%20check%20the%20workspace%20id%20from%20the%20request%20is%20in%20bb%28%29.workspace.list%28%29%20from%20src%2Fserver%2Fbuildbase.ts%20before%20reading%20or%20writing%20its%20rows.%0ADo%20not%20create%20workspace%2C%20membership%20or%20role%20tables%20in%20Lovable%20Cloud%20or%20Supabase%3B%20BuildBase%20holds%20them.)

The link opens a new Lovable project with the prompt filled in and not sent. For the app you already have, paste the prompt into that project's chat instead.

```text
This app signs people in with BuildBase (@buildbase/sdk), set up as https://www.buildbase.app/guides/add-login-teams-and-paid-plans-to-a-lovable-app shows. If it does not, stop and tell me.
Read https://docs.buildbase.app/workspaces/overview.md first and do not invent endpoints.
- Add WorkspaceSwitcher from @buildbase/sdk/react to the header, and a Members button that calls openWorkspaceSettings('users') from useSaaSAuth().
- Give every table of mine a workspace_id column and filter every query by currentWorkspace._id from useSaaSWorkspaces().
- In TanStack Start server routes, check the workspace id from the request is in bb().workspace.list() from src/server/buildbase.ts before reading or writing its rows.
Do not create workspace, membership or role tables in Lovable Cloud or Supabase; BuildBase holds them.
```

## Where the secrets go

This job adds no new secret. `BUILDBASE_CLIENT_SECRET` stays where the guide put it: **More** > **Settings** > **Secrets**, never in `.env` and never with a `VITE_` prefix. The server routes use the signed-in person's session cookie, `bb-session-id`.

## The Lovable trap

Row-level security policies keyed to the old sign-in (`auth.uid()`) do not know who a BuildBase user is, because a BuildBase session is an opaque id, not a token Supabase reads. Rows vanish, or a query answers "permission denied". Read and write through server routes that check the workspace, as the prompt asks, or follow the guide's section on minting a Supabase-shaped token.

Then test it: sign in as a member of one workspace and change an id in the address bar. If you see another workspace's rows, a query is missing its `workspace_id` filter.

## Full guides

- [Add login, teams and paid plans to a Lovable app](https://www.buildbase.app/guides/add-login-teams-and-paid-plans-to-a-lovable-app)
- [Workspaces](/workspaces/overview) and [invitations](/workspaces/invitations)
- [Add BuildBase to Lovable's instructions or skills](/ai-builders/lovable-import)