Resolving Access Issues for Shared Lovable Projects

Why shared Lovable projects show access denied or permission errors

Lovable organizes work into workspaces, and every project lives inside one workspace. When you share a project link with someone, they can only open it if they belong to that workspace or if the project is set to public visibility. Many users assume that sending a project URL is enough, but Lovable checks workspace membership before granting editor access. Another common issue is invite link expiration. Lovable invite links have a limited lifespan, and if a collaborator clicks an old link, they see an error instead of the project. This is especially confusing because the link looks valid in the browser address bar. Finally, workspace roles matter. Lovable distinguishes between owners, admins, and members. Members can view and edit projects, but only admins and owners can manage connectors, billing, and workspace settings. If a collaborator needs to change environment secrets or connect GitHub, they need an elevated role — not just basic project access.

• Collaborator is not a member of the workspace that contains the project
• Project visibility is set to workspace-only but the recipient is outside the workspace
• Invite link has expired or was already used by a different account
• Collaborator signed into a different Lovable account than the one invited
• Workspace role is too restrictive for the action the collaborator needs to perform

Error messages you might see

Before you start

• A Lovable account with owner or admin role in the workspace
• The email address of the collaborator you want to invite
• The project open in the Lovable editor so you can check its visibility settings

How to fix it

Complete code example

1import { useEffect, useState } from "react";
2import { useNavigate } from "react-router-dom";
3import { supabase } from "@/integrations/supabase/client";
4
5interface ProtectedRouteProps {
6  children: React.ReactNode;
7  requiredRole?: "admin" | "member";
8}
9
10export default function ProtectedRoute({ children, requiredRole = "member" }: ProtectedRouteProps) {
11  const navigate = useNavigate();
12  const [isAuthorized, setIsAuthorized] = useState(false);
13  const [isLoading, setIsLoading] = useState(true);
14
15  useEffect(() => {
16    async function checkAccess() {
17      const { data: { session } } = await supabase.auth.getSession();
18
19      if (!session) {
20        // Redirect unauthenticated users to the login page
21        navigate("/login", { replace: true });
22        return;
23      }
24
25      if (requiredRole === "admin") {
26        // Query the profiles table to verify the user has an admin or owner role
27        const { data: profile } = await supabase
28          .from("profiles")
29          .select("role")
30          .eq("id", session.user.id)
31          .single();
32
33        if (profile?.role !== "admin" && profile?.role !== "owner") {
34          navigate("/unauthorized", { replace: true });
35          return;
36        }
37      }
38
39      setIsAuthorized(true);
40      setIsLoading(false);
41    }
42
43    checkAccess();
44  }, [navigate, requiredRole]);
45
46  if (isLoading) {
47    return (
48      <div className="flex items-center justify-center min-h-screen">
49        <p className="text-muted-foreground">Checking access...</p>
50      </div>
51    );
52  }
53
54  // Only render children once authorization is confirmed
55  return isAuthorized ? <>{children}</> : null;
56}

Best practices to prevent this

• Always invite collaborators by email through Workspace Settings rather than sharing project URLs directly — URLs alone do not grant editor access
• Use the principle of least privilege: start collaborators as Members and promote to Admin only when they need access to secrets or connectors
• Send fresh invite links rather than reusing old ones — expired links cause silent failures that are hard to debug
• Keep your workspace member list clean by removing people who no longer need access, especially those with admin or owner roles
• For client projects, consider creating a separate workspace per client to isolate project access and billing
• Set published app visibility to 'Anyone' for public-facing apps and 'Workspace only' for internal tools or staging environments
• Document your workspace roles and access policies so team members know whom to contact for permission changes

Still stuck?

Copy one of these prompts to get a personalized, step-by-step explanation.

Related error patterns