Add teams to a Replit app (React and Express, BuildBase sign-in)
One prompt that adds a workspace switcher, members and email invites to a Replit Agent app, and scopes your own tables by workspace.
Replit can also connect to BuildBase itself while it builds: Use BuildBase in Replit.
Each customer gets a workspace, a switcher in the header, and a members screen where an admin invites a colleague by email. Workspaces, members and roles live in BuildBase; your own tables stay in Replit Database, scoped by the workspace id. This page assumes the app already signs people in with @buildbase/sdk, as the Replit guide sets up. If it signs people in with something else, such as Supabase or Clerk, read keep your existing sign-in first.
Before you start
A sender connected in the console, so invitation emails go out (connect a sender).
The prompt
The link opens Replit Agent with the prompt filled in, for a new app; you still send it yourself. For the app you already have, paste the prompt into Agent's chat in that project instead.
This app signs people in with BuildBase (@buildbase/sdk), set up as https://www.buildbase.app/guides/add-login-teams-and-paid-plans-to-a-replit-app shows. If it does not, stop and tell me.
Read https://docs.buildbase.app/workspaces/overview.md first and do not invent endpoints.
- Add WorkspaceSwitcher from @buildbase/sdk/react to the header, and a Members button that calls openWorkspaceSettings('users') from useSaaSAuth().
- Give every table of mine a workspace_id column and filter every query by currentWorkspace._id from useSaaSWorkspaces().
- In Express routes, check the workspace id from the request is in bbFor(req).workspace.list() from server/buildbase.ts before reading or writing its rows.
Do not create workspace, membership or role tables in Replit Database, and do not add Replit Auth or Clerk; BuildBase holds them.Where the secrets go
This job adds no new secret. BUILDBASE_CLIENT_SECRET stays where the guide put it: the Secrets tool (Tools > Secrets), and again under Publishing > Adjust settings > Production app secrets. Never give it a VITE_ prefix. The routes use the signed-in person's session cookie, bb-session-id.
The Replit trap
Replit Database is PostgreSQL that your Express server reads with a server-side connection, so there is no row rule to fall back on: the check lives in the route or nowhere. The bug to look for in every change Agent makes is a query that filters by the row id and not by workspace_id.
Test it: sign in as a member of one workspace and change an id in the address bar. If you see another workspace's rows, a query is missing its filter. Keep the guide's two lines in replit.md, which Agent reads before every request, so the habit outlives this prompt.