Editors

Syntax

Each entry uses one of three forms:

Domain matching is exact: example.com matches ada@example.com, but not ada@mail.example.com. The domain is the account's email domain, not the deployment's hostname. Every matching entry grants the same editor rights; * grants deployment editing to all signed-in accounts.

Normalization and validation

The field lowercases entries and removes the first run of whitespace. Use lowercase entries without whitespace; do not rely on it removing several separate runs. These rules were checked on 2026-10-13.

A domain must contain a dot and use labels of letters, digits and hyphens, with no leading or trailing hyphen. Single-label domains, IP addresses and wholly numeric final labels are rejected. The field reports Invalid for a rejected entry and Duplicate for an existing normalized value.

See Code.W for the array API, sorting and storage behavior.

Owner and editor permissions

The first account to deploy a route owns it. An editor's deploy keeps that owner and records the editor as the saver of the version.

Editor access to one route grants no control over the owner's other routes or domain. It does not let an editor create new routes under that owner's claimed host.

An editor's redeploy is refused if its Editors list differs from the deployed list. For a deployment to several routes, the editor must be authorized for every target and keep each saved list unchanged; all targets must have the same owner.

Add editors

1. Sign in as the route's owner and open its source in the playground.
2. Open the Code dialog with Set Routes… (Alt+R / ⌥+R). Add the accounts or domains to Editors.
3. Review Routes, confirm the dialog, and deploy. Pressing Set alone changes only the playground configuration.

From the playground console or io.eval.js, the owner can add one account while keeping the other entries:

Code.D // Review the routes this deployment will update.
Code.W = [...Code.W, 'ada@example.com'];
await edge.save.limit({ message: 'Editors: add Ada' });

The new list takes effect for each route successfully published by that deploy. Routes omitted from the current list retain their saved editor permissions. Check the deploy results for every intended route; see Deploying to RTEdge.net.

Remove editors

As the owner, remove an entry from the Code dialog's Editors field and deploy again. The equivalent code removes one exact entry:

Code.W = Code.W.filter(entry => entry !== 'ada@example.com');
await edge.save.limit({ message: 'Editors: remove Ada' });

Removing that email does not remove access granted by another entry. Ada remains an editor if example.com or * is still listed. To clear every editor entry, set Code.W = [] and deploy. The owner's rights remain.

Redeploy every route where the change should apply. Removing a route from Code.D leaves its existing editor permissions unchanged.

Viewing and source access

Editors are automatically allowed through the platform's edge:user page-access checks and io:user source-access checks. Those attributes can grant other people viewing or source access without making them editors.

Adding editors does not make a public page or source private. Removing an editor may still leave that person able to view the page or open its source through public access or a matching attribute permit. Use Restricting access to configure those permissions separately.

See also

• Code.W
• Routes
• Deploying to RTEdge.net
• Restricting access
• Security and access model
• Versions and undo