different-ai/openwork · error

Only workspace admins can invite members.

Error message

Only workspace admins can invite members.

What it means

inviteMember checks the current member's access flags (derived from role, isOwner, and custom roles via getOrgAccessFlags) before allowing an invitation. If access.canInviteMembers is false the provider throws "Only workspace admins can invite members." instead of calling the invitation API. It is an intentional client-side authorization gate mirroring server-side RBAC.

Source

Thrown at ee/apps/den-web/app/(den)/dashboard/_providers/org-dashboard-provider.tsx:587

    await runReauthableAction("delete-organization", async () => {
      ensureActiveOrganizationSelected();
      const { response, payload } = await requestJson(
        "/v1/org",
        { method: "DELETE" },
        12000,
      );

      if (!response.ok) {
        throw getRequestError(payload, response, `Failed to delete organization (${response.status}).`);
      }
    });
  }

  async function inviteMember(input: { email: string; role: string }) {
    const access = getCurrentAccess();
    if (!access.canInviteMembers) {
      throw new Error("Only workspace admins can invite members.");
    }
    const invitationRole = access.canManageRoles ? input.role : "member";
    ensureRoleCanBeAssigned(invitationRole);

    await runMutation("invite-member", async () => {
      ensureActiveOrganizationSelected();
      const { response, payload } = await requestJson(
        "/v1/invitations",
        {
          method: "POST",
          body: JSON.stringify({ email: input.email, role: invitationRole }),
        },
        12000,
      );

      if (!response.ok) {
        const paymentRequiredError = getOrgPaymentRequiredError(payload);
        if (paymentRequiredError) {

View on GitHub (pinned to 2b7df46e8a)

Solutions

1. Ask a workspace owner, super-admin, or admin to send the invitation.
2. Verify the current member's role in the active organization (Settings → Members).
3. Refresh org context so role changes are reflected, then retry if the member was actually promoted.
4. Hide the invite UI for members lacking canInviteMembers instead of allowing the attempt.

Example fix

// before
await inviteMember({ email, role });

// after
if (!getCurrentAccess().canInviteMembers) {
  showNotice("Only workspace admins can invite members.");
  return;
}
await inviteMember({ email, role });

if (!access.canInviteMembers) {
  // hide/disable invite form before calling inviteMember
}

try {
  await inviteMember({ email, role });
} catch (e) {
  if (e instanceof Error && e.message.startsWith("Only workspace admins")) {
    setPermissionError(e.message);
  } else throw e;
}

When it happens

Trigger: Calling inviteMember({ email, role }) while the signed-in member's role resolves to a non-admin (e.g. plain "member") in the active organization, so canInviteMembers is false.

Common situations: A regular member reaches the Manage Members UI (e.g. via stale navigation or a shared link) and submits the invite form; a role downgrade happened server-side and orgContext still shows old privileges; the wrong organization is active.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• Only workspace owners and super-admins can change settings.
• Only the workspace owner can delete this organization.
• The owner role cannot be assigned from this action.
• The workspace owner cannot be changed or removed from this a
• Only workspace admins can start seat checkout.

AI-assisted analysis of different-ai/openwork@2b7df46e8a (2026-09-01). Data as JSON: /api/errors/75352851fe891ee7. Report an issue: GitHub.