> ## Documentation Index
> Fetch the complete documentation index at: https://docs.marina.cloud/llms.txt
> Use this file to discover all available pages before exploring further.

# Users, sharing, and approvals

> Who can open an app, what your code knows about them, and how changes get approved.

Marina authenticates every viewer before a request reaches your app. You do
not build sign-in; you decide who an app is shared with, and your code reads
who is asking.

## Who is making the request

Each request arrives with identity headers your code can trust:

| Header | Value |
| - | - |
| `x-platform-principal` | `user` for a signed-in user. |
| `x-platform-user-id` | The signed-in user's stable id. |
| `x-platform-workspace-id` | The workspace the app belongs to. |

```ts theme={null}
const userId = request.headers.get("x-platform-user-id");
const rows = await marina.db.query(
  "select * from expenses where owner_id = $1",
  [userId],
);
```

Use the user id in your data model and query predicates. Marina isolates apps
from each other; separating one app's users from each other is your code's
job.

## Requests without a browser

Two features let callers without a Marina sign-in reach an app that handles
requests. Neither carries a user id, and `x-platform-principal` tells your
code which kind of request it is handling.

| Caller | Use | `x-platform-principal` |
| - | - | - |
| CI jobs, scripts, and other services | [App keys](/guides/app-keys): keys with scopes your app declares, valid until revoked or expired. | `app-key` |
| A device or service that needs one route briefly, such as a download or callback | [Temporary links](/guides/temporary-links): URLs for one route that your app creates, valid for at most 15 minutes. | `grant` |

## Sharing an app

A new app is visible to its creator and to workspace admins. Share it from
the app's sharing controls, per person or with the whole workspace, with one
of three roles:

| Role | Can |
| - | - |
| Viewer | Open and use the app. |
| Editor | Also change the app: edit in Studio and deploy new versions. |
| Publisher | Also approve versions and manage the app. |

**Guests** are people outside your workspace membership, invited by email
from an app's sharing settings. They can use the apps shared with them and
nothing else: no connections, no groups, no workspace settings.

## Approvals

Deployments that expand what an app can touch require approval before the
version goes live: a new runtime service, a new connection or operation, or
database migrations. The exact changes appear as plain-language effects
("Let this app read mercury/evident: transactions.list") in the **Inbox** of
people who can approve, and the approved list becomes that version's fixed
authority. Deployments that change only code publish without a review.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.