Manage every Clerk customer workspace from one console

Build me a workspace admin console my ops team can run our B2B customer accounts from, instead of clicking through the Clerk dashboard one organization at a time. Every customer of ours is a Clerk organization. The app has two surfaces: a landing view listing every customer workspace, and a detail page for a single workspace. Scope this to membership and invitation administration only. Do not pull in billing or subscription data.

The landing view is a table of every customer workspace, loaded with the Clerk operation Get a list of organizations for an instance. Enrich each row with membership data from Get a list of all organization memberships within an instance, grouped by organization, so one instance wide read gives me a member count and a role breakdown (how many admins, how many other members) for every workspace without making one call per workspace. Pending invite counts come from Get a list of organization invitations for the current instance, counting only invitations still in a pending state. All three of these are offset paginated and return a data array alongside total_count, with limit defaulting to 10 and capping at 500, so page through with a high limit until total_count is covered rather than showing me only the first page.

Table columns: workspace name, member count, admin count, other roles, pending invitations, age of the oldest pending invitation, and when the workspace was created. Every column sortable. Give me three filters I can toggle on and off: workspaces with no admin, workspaces with only one member, and workspaces with invitations that have been sitting unaccepted.

Bake in this rule above everything else: any workspace with zero admins is a red state and pins to the top of the list regardless of the current sort, with a short line explaining that nobody in that workspace can manage the account. That is the single most valuable thing this view surfaces. Workspaces with only one member deserve a softer warning treatment, since they are one departure away from the same problem.

Clicking a workspace row opens its detail page. Show the member list with name, email, role, and last activity. Name, email identifier, and role all come off the membership records, which you can read for a single workspace with Get a list of all members of an organization. Last activity needs the underlying user record, so call Retrieve a user for each member of that one workspace and read the last sign in timestamp. Only do this on the detail page, one workspace at a time, because there is no bulk user list operation to lean on and doing it across the whole instance would be far too many calls.

Below the members list, a pending invitations panel for that workspace showing the invited email, the role they were invited as, who sent it, and how long it has been waiting. From the detail page the ops person can invite a new member with Create and send an organization invitation (let them pick the role at invite time), change someone's role with Update an organization membership, remove a member with Remove a member from an organization, and cancel an invitation with Revoke a pending organization invitation. After any of these succeed, refresh the affected data so the page reflects the change immediately, and show a clear confirmation of what happened.

Two safety rules matter. Treat any invitation older than 14 days as stale, mark it visually in both the panel and the landing table, and give it a one click revoke button so clearing them out is quick. And before removing a member who is the last remaining admin of their workspace, interrupt with an explicit warning that this leaves nobody able to manage the account, and make the person confirm deliberately rather than letting it slip through a normal confirm dialog. The same warning applies to demoting the last admin down to a regular member role.

Clerk returns every timestamp as Unix epoch milliseconds, which is unreadable to an ops person, so convert them everywhere. Show sign in recency in plain language like "Active 3 days ago", "Active 2 months ago", or "Never signed in" for someone who has an account but has never logged in, and expose the exact date on hover for anyone who needs it. Invitation ages read the same way.

Both views get an "Export roster" button that pushes the member list currently on screen to a spreadsheet using the Google Sheets Append Values operation, so we build up a dated record for quarterly access reviews. From the landing view export every workspace's members; from a detail page export just that workspace. Each appended row should carry the export date, workspace name, member name, email, role, and last activity, so a quarter of exports stacks up in one tab as a history rather than overwriting. Ask me once for the spreadsheet and tab to append to and remember it for later exports.