Shared machines for small teams
Stop sharing keys. Each kind of access is a rule you can read, and it ends the moment you remove it.
$ pb team invite acme bo@example.com$ pb team machine grant acme <machine-id> --member <bo> --capability terminal,exec$ pb preview 3000 --team
Preview ready
https://quiet-river-lantern-4821.pprbt.app -> http://127.0.0.1:3000- 1
Bo joins the team. That alone opens nothing.
- 2
Bo gets a terminal and commands on staging. No SSH, no ports, no files.
- 3
A review link only teammates you grant can open.
A week on a small team
The things that usually mean a ticket, a shared password or a message that says "can you send me the key".
| A new developer starts | Invite them and add one rule. They install pb, sign in, and the staging box is there. No VPN profile, no key to collect. |
|---|---|
| A pull request needs eyes | pb preview 3000 --team on your laptop. Reviewers open the link; nobody else can. |
| The staging database needs a look | A rule grants port 5432 on that one machine. pb access machine staging --port 5432 and the usual client. |
| A deploy script needs the API key | The key is in the team's ENV. pb env run -- ./deploy.sh on the build machine; nobody pastes it into chat. |
| Something breaks at night | Share your terminal session. A colleague watches, then types, in the same shell. |
| Someone leaves | Remove them. Their sessions end at once, their tokens stop working, and the audit log shows what they did last. |
What it costs
$15 a seat a month, or $150 a year, with unlimited machines. Five people is $75 a month.
The trial is 14 days. Single sign-on and directory sync start at 10 seats.
Where a bigger tool fits better. For access requests with approvals, or Kubernetes and database sessions audited per query, use Teleport. Paperboat records its own terminals on Team, archived to your S3 bucket.
Questions
Do we need the Team plan to work together?
Not always. Sharing a live terminal or a preview link works on Free. Team, at $15 a seat a month, is for lasting access to each other's machines, with roles and an exportable audit log. Single sign-on and directory sync start at 10 seats. It has a 14-day trial.
We already have a VPN. Why this?
A VPN puts people on a network and leaves everything else to you: accounts on each box, keys, tmux, a tunnel service, a secrets store. Paperboat is those pieces with one access policy. If you need whole networks joined, keep the VPN; the two do not conflict.
Who owns a machine a member brings?
They do, until they transfer it. Sharing a personal machine with the team lends it; leaving the team takes it back. A machine enrolled into the team belongs to the team.
How is the bandwidth counted for a team?
Each member has 100 GB a month of relay and edge traffic inside the team. Extra bandwidth goes into one shared pool. Direct traffic between machines is never counted.
Is there a contract or a minimum?
No. One seat is the minimum, billed monthly or yearly by card, and you can cancel in the console.
Related
Start with the machine in front of you
Install Paperboat here, then on a second machine. Free for personal use, no card needed.
$ curl -fsSL https://get.pprbt.dev/install | bash > irm https://get.pprbt.dev/install.ps1 | iex