diff --git a/src/main/java/io/seqera/tower/cli/commands/studios/AbstractStudiosCmd.java b/src/main/java/io/seqera/tower/cli/commands/studios/AbstractStudiosCmd.java
index 37e42fcc9..bc34037a2 100644
--- a/src/main/java/io/seqera/tower/cli/commands/studios/AbstractStudiosCmd.java
+++ b/src/main/java/io/seqera/tower/cli/commands/studios/AbstractStudiosCmd.java
@@ -26,6 +26,7 @@
 import io.seqera.tower.cli.commands.AbstractApiCmd;
 import io.seqera.tower.cli.commands.data.links.DataLinkService;
 import io.seqera.tower.cli.commands.labels.Label;
+import io.seqera.tower.cli.exceptions.MemberNotFoundException;
 import io.seqera.tower.cli.exceptions.StudioNotFoundException;
 import io.seqera.tower.model.DataStudioConfiguration;
 import io.seqera.tower.cli.commands.enums.OutputType;
@@ -35,6 +36,8 @@
 import io.seqera.tower.model.DataStudioStatusInfo;
 import io.seqera.tower.model.DataStudioTemplate;
 import io.seqera.tower.model.DataStudioTemplatesListResponse;
+import io.seqera.tower.model.ListMembersResponse;
+import io.seqera.tower.model.MemberDbDto;
 
 import static io.seqera.tower.cli.utils.ResponseHelper.waitStatus;
 import static io.seqera.tower.model.DataStudioProgressStepStatus.ERRORED;
@@ -46,19 +49,16 @@ public class AbstractStudiosCmd extends AbstractApiCmd {
     protected String getSessionId(StudioRefOptions studioRefOptions, Long wspId) throws ApiException {
         return studioRefOptions.studio.sessionId != null
                 ? studioRefOptions.studio.sessionId
-                : fetchStudio(studioRefOptions, wspId).getSessionId();
+                : getStudioByName(wspId, studioRefOptions.studio.studioName).getSessionId();
     }
 
     protected DataStudioDto fetchStudio(StudioRefOptions studioRefOptions, Long wspId) throws ApiException {
-        DataStudioDto studio;
-
         if (studioRefOptions.studio.sessionId != null) {
-            studio = getStudioById(wspId, studioRefOptions.studio.sessionId);
-        } else {
-            studio = getStudioByName(wspId, studioRefOptions.studio.studioName);
+            return getStudioById(wspId, studioRefOptions.studio.sessionId);
         }
 
-        return studio;
+        String sessionId = getStudioByName(wspId, studioRefOptions.studio.studioName).getSessionId();
+        return getStudioById(wspId, sessionId);
     }
 
     protected String getParentStudioSessionId(ParentStudioRefOptions parentStudioRefOptions, Long wspId) throws ApiException {
@@ -92,6 +92,44 @@ private DataStudioDto getStudioById(Long wspId, String sessionId) throws ApiExce
         return studiosApi().describeDataStudio(sessionId, wspId);
     }
 
+    /**
+     * Resolves each {@code --allow-user} value (a numeric user ID, username, or email) to a numeric
+     * user ID. Returns {@code null} when nothing was provided, so the allow list is left untouched.
+     */
+    protected List<Long> resolveAllowedUserIds(String allowUser, Long wspId) throws ApiException {
+        if (allowUser == null) {
+            return null;
+        }
+        // The platform currently permits a single additional user, so the CLI exposes one value; the
+        // API field is a list for forward-compatibility, hence the resolved id is wrapped in a list.
+        return List.of(resolveUserId(allowUser, wspId));
+    }
+
+    private Long resolveUserId(String userToAllow, Long wspId) throws ApiException {
+        // A numeric value is treated as a user ID directly.
+        if (userToAllow != null && !userToAllow.isEmpty() && userToAllow.chars().allMatch(Character::isDigit)) {
+            return Long.parseLong(userToAllow);
+        }
+        // Resolve the username/email to a user ID. A workspace participant may be a full organization
+        // member or a collaborator (role=collaborator, which listOrganizationMembers excludes), so check
+        // both. The backend still enforces that the resolved user is a participant of the workspace.
+        Long organizationId = orgId(wspId);
+        MemberDbDto member = firstMember(orgsApi().listOrganizationMembers(organizationId, null, null, userToAllow));
+        if (member == null) {
+            member = firstMember(orgsApi().listOrganizationCollaborators(organizationId, null, null, userToAllow));
+        }
+        if (member == null || member.getUserId() == null) {
+            throw new MemberNotFoundException(organizationId, userToAllow);
+        }
+        return member.getUserId();
+    }
+
+    private static MemberDbDto firstMember(ListMembersResponse response) {
+        return response == null || response.getMembers() == null
+                ? null
+                : response.getMembers().stream().findFirst().orElse(null);
+    }
+
     protected Integer onBeforeExit(int exitCode, String sessionId, Long workspaceId, DataStudioStatus targetStatus) {
         boolean showProgress = app().output != OutputType.json;
 
diff --git a/src/main/java/io/seqera/tower/cli/commands/studios/AddAsNewCmd.java b/src/main/java/io/seqera/tower/cli/commands/studios/AddAsNewCmd.java
index a8bd06fc6..d0d46a33a 100644
--- a/src/main/java/io/seqera/tower/cli/commands/studios/AddAsNewCmd.java
+++ b/src/main/java/io/seqera/tower/cli/commands/studios/AddAsNewCmd.java
@@ -66,6 +66,9 @@ public class AddAsNewCmd extends AbstractStudiosCmd{
     @CommandLine.Option(names = {"--private"}, description = "Create a private studio that only you can access or manage (default: false)", defaultValue = "false")
     public Boolean isPrivate;
 
+    @CommandLine.Option(names = {"--allow-user"}, description = "User (numeric ID, username, or email), besides the creator, allowed to connect to and start this studio when it is private.")
+    public String allowedUser;
+
     @CommandLine.Option(names = {"--labels"}, description = "Comma-separated list of labels", split = ",", converter = Label.StudioResourceLabelsConverter.class)
     public List<Label> labels;
 
@@ -99,6 +102,7 @@ DataStudioCreateRequest prepareRequest(DataStudioDto parentDataStudio, String pa
         }
         request.setLabelIds(getLabelIds(labels, wspId));
         request.setIsPrivate(isPrivate);
+        request.setAllowedUserIds(resolveAllowedUserIds(allowedUser, wspId));
         if (parentCheckpointId == null) {
             DataStudioListCheckpointsResponse response = studiosApi().listDataStudioCheckpoints(parentDataStudio.getSessionId(), parentDataStudio.getWorkspaceId(), null, 1, null);
             if (!response.getCheckpoints().isEmpty()) {
diff --git a/src/main/java/io/seqera/tower/cli/commands/studios/AddCmd.java b/src/main/java/io/seqera/tower/cli/commands/studios/AddCmd.java
index 9729c8317..0fe5a44ea 100644
--- a/src/main/java/io/seqera/tower/cli/commands/studios/AddCmd.java
+++ b/src/main/java/io/seqera/tower/cli/commands/studios/AddCmd.java
@@ -82,6 +82,9 @@ public class AddCmd extends AbstractStudiosCmd{
     @CommandLine.Option(names = {"--ssh"}, description = "Enable SSH connectivity to the studio (default: false).")
     public Boolean ssh;
 
+    @CommandLine.Option(names = {"--allow-user"}, description = "User (numeric ID, username, or email), besides the creator, allowed to connect to and start this studio when it is private.")
+    public String allowedUser;
+
     @CommandLine.Option(names = {"--labels"}, description = "Comma-separated list of labels", split = ",", converter = Label.StudioResourceLabelsConverter.class)
     public List<Label> labels;
 
@@ -131,6 +134,7 @@ DataStudioCreateRequest prepareRequest(Long wspId) throws ApiException {
         if (description != null && !description.isEmpty()) {request.description(description);}
         request.setLabelIds(getLabelIds(labels, wspId));
         request.setIsPrivate(isPrivate);
+        request.setAllowedUserIds(resolveAllowedUserIds(allowedUser, wspId));
         if (spot != null) {
             request.setSpot(spot);
         }
diff --git a/src/main/java/io/seqera/tower/cli/commands/studios/StartCmd.java b/src/main/java/io/seqera/tower/cli/commands/studios/StartCmd.java
index dcc2bb3ee..5f21b5202 100644
--- a/src/main/java/io/seqera/tower/cli/commands/studios/StartCmd.java
+++ b/src/main/java/io/seqera/tower/cli/commands/studios/StartCmd.java
@@ -64,6 +64,9 @@ public class StartCmd extends AbstractStudiosCmd {
     @CommandLine.Option(names = {"--ssh"}, description = "Optional override to enable SSH connectivity to the studio.")
     public Boolean ssh;
 
+    @CommandLine.Option(names = {"--allow-user"}, description = "Override the user (numeric ID, username, or email), besides the creator, allowed to connect to and start this studio when it is private. Omit to leave the allow list unchanged. Only the studio creator may change it.")
+    public String allowedUser;
+
     @Override
     protected Response exec() throws ApiException {
         Long wspId = workspaceId(workspace.workspace);
@@ -115,6 +118,7 @@ private DataStudioStartRequest getStartRequestWithOverridesApplied(DataStudioDto
         request.setConfiguration(newConfig);
         request.setDescription(appliedDescription);
         request.setLabelIds(getLabelIds(labels, studioDto.getWorkspaceId()));
+        request.setAllowedUserIds(resolveAllowedUserIds(allowedUser, studioDto.getWorkspaceId()));
         if (spot != null) {
             request.setSpot(spot);
         }
diff --git a/src/main/java/io/seqera/tower/cli/responses/studios/StudiosView.java b/src/main/java/io/seqera/tower/cli/responses/studios/StudiosView.java
index 9f62bd9aa..5a7eca78b 100644
--- a/src/main/java/io/seqera/tower/cli/responses/studios/StudiosView.java
+++ b/src/main/java/io/seqera/tower/cli/responses/studios/StudiosView.java
@@ -58,6 +58,8 @@ public void toString(PrintWriter out){
         table.addRow("Description", formatDescription(studio.getDescription(), 100));
         table.addRow("Created on", formatTime(studio.getDateCreated()));
         table.addRow("Created by", studioUser == null ? "NA" : String.format("%s | %s",studioUser.getUserName(), studioUser.getEmail()));
+        table.addRow("Allowed users", studio.getAllowedUsers() == null || studio.getAllowedUsers().isEmpty() ? "NA" : studio.getAllowedUsers()
+                .stream().map(u -> String.format("%s | %s", u.getUserName(), u.getEmail())).collect(java.util.stream.Collectors.joining(", ")));
         table.addRow("Template", studio.getTemplate() == null ? "NA" : studio.getTemplate().getRepository());
         table.addRow("Mounted data", studio.getMountedDataLinks() == null ? "NA" : studio.getMountedDataLinks()
                 .stream().map(DataLinkDto::getResourceRef).collect(java.util.stream.Collectors.joining(", ")));
diff --git a/src/test/java/io/seqera/tower/cli/studios/StudiosCmdTest.java b/src/test/java/io/seqera/tower/cli/studios/StudiosCmdTest.java
index d631b21f4..12704ca5d 100644
--- a/src/test/java/io/seqera/tower/cli/studios/StudiosCmdTest.java
+++ b/src/test/java/io/seqera/tower/cli/studios/StudiosCmdTest.java
@@ -48,6 +48,7 @@
 import java.util.List;
 
 import org.mockserver.client.MockServerClient;
+import org.mockserver.matchers.MatchType;
 import org.mockserver.model.MediaType;
 import org.mockserver.verify.VerificationTimes;
 
@@ -155,6 +156,116 @@ void testView(OutputType format, MockServerClient mock) throws JsonProcessingExc
                 }""", DataStudioDto.class), "[organization1 / workspace1]" ));
     }
 
+    @ParameterizedTest
+    @EnumSource(OutputType.class)
+    void testViewByName(OutputType format, MockServerClient mock) throws JsonProcessingException {
+        mock.when(
+                request().withMethod("GET").withPath("/user-info"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody(loadResource("user")).withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        mock.when(
+                request().withMethod("GET").withPath("/user/1264/workspaces"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody(loadResource("workspaces/workspaces_list")).withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        // the name is resolved to a session id via the list endpoint...
+        mock.when(
+                request().withMethod("GET").withPath("/studios").withQueryStringParameter("workspaceId", "75887156211589"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody(loadResource("studios/studios_list_response")).withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        // ...then the full detail (including allowedUsers) is fetched by that id, since the list DTO is partial
+        mock.when(
+                request().withMethod("GET").withPath("/studios/3e8370e7").withQueryStringParameter("workspaceId", "75887156211589"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody(loadResource("studios/studios_view_response_with_allowed_users")).withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        ExecOut out = exec(format, mock, "studios", "view", "-w", "75887156211589", "-n", "studio-a66d");
+
+        assertOutput(format, out, new StudiosView(parseJson("""
+                {
+                  "sessionId": "3e8370e7",
+                  "workspaceId": 75887156211589,
+                  "user": {
+                    "id": 2345,
+                    "userName": "John Doe",
+                    "email": "john@seqera.io",
+                    "avatar": null
+                  },
+                  "allowedUsers": [
+                    {
+                      "id": 21,
+                      "userName": "nonowner",
+                      "email": "nonowner@seqera.io",
+                      "avatar": null
+                    }
+                  ],
+                  "name": "studio-a66d",
+                  "description": "my first studio",
+                  "studioUrl": "https://a3e8370e7.dev-tower.com",
+                  "computeEnv": {
+                    "id": "3xkkzYH2nbD3nZjrzKm0oR",
+                    "name": "ce1",
+                    "platform": "aws-batch",
+                    "region": "us-east-2"
+                  },
+                  "template": {
+                    "repository": "cr.seqera.io/public/data-studio-vscode:1.93.1-snapshot",
+                    "icon": "vscode"
+                  },
+                  "configuration": {
+                    "gpu": 0,
+                    "cpu": 2,
+                    "memory": 8192,
+                    "mountData": [
+                      "v1-user-1ccf131810375d303bf0402dd8423433"
+                    ],
+                    "condaEnvironment":null
+                  },
+                  "dateCreated": "2024-12-19T06:49:24.893122+01:00",
+                  "lastUpdated": "2024-12-19T06:52:50.686822+01:00",
+                  "statusInfo": {
+                    "status": "running",
+                    "message": "",
+                    "lastUpdate": "2024-12-19T05:52:41.823Z"
+                  },
+                  "waveBuildUrl": null,
+                  "baseImage": "cr.seqera.io/public/data-studio-jupyter:4.2.5-snapshot",
+                  "isPrivate": true,
+                  "mountedDataLinks": [
+                    {
+                      "id": "v1-user-1ccf131810375d303bf0402dd8423433",
+                      "name": "aaa-my-bucket",
+                      "resourceRef": "s3://aaa-my-bucket",
+                      "type": "bucket",
+                      "provider": "aws",
+                      "region": "us-east-2"
+                    }
+                  ],
+                  "progress": [
+                    {
+                      "status": "succeeded",
+                      "message": "Provisioning compute resources",
+                      "warnings": null
+                    },
+                    {
+                      "status": "succeeded",
+                      "message": "Mounting checkpoints",
+                      "warnings": null
+                    }
+                  ]
+                }""", DataStudioDto.class), "[organization1 / workspace1]" ));
+
+        // proves the fetch-then-describe path: name resolved via list, full detail fetched by id
+        mock.verify(request().withMethod("GET").withPath("/studios").withQueryStringParameter("workspaceId", "75887156211589"), VerificationTimes.exactly(1));
+        mock.verify(request().withMethod("GET").withPath("/studios/3e8370e7").withQueryStringParameter("workspaceId", "75887156211589"), VerificationTimes.exactly(1));
+    }
+
     @Test
     void testViewForbidden(MockServerClient mock) {
         mock.when(
@@ -757,6 +868,54 @@ void testStart(OutputType format, MockServerClient mock) {
                 "[organization1 / workspace1]",  "http://localhost:"+mock.getPort()+"/orgs/organization1/workspaces/workspace1", true));
     }
 
+    @ParameterizedTest
+    @EnumSource(OutputType.class)
+    void testStartWithAllowedUser(OutputType format, MockServerClient mock) {
+
+        mock.when(
+                request().withMethod("GET").withPath("/user-info"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody(loadResource("user")).withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        mock.when(
+                request().withMethod("GET").withPath("/user/1264/workspaces"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody(loadResource("workspaces/workspaces_list")).withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        mock.when(
+                request().withMethod("GET").withPath("/studios/3e8370e7").withQueryStringParameter("workspaceId", "75887156211589"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody(loadResource("studios/studios_view_response_studio_stopped")).withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        // A username override is resolved to a user id via the organization members.
+        mock.when(
+                request().withMethod("GET").withPath("/orgs/27736513644467/members"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody("{\"members\":[{\"memberId\":1,\"userId\":7,\"userName\":\"someuser\",\"email\":\"someuser@seqera.io\",\"role\":\"member\"}],\"totalSize\":1}").withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        // Assert the resolved id (7) is sent on the start request.
+        mock.when(
+                request().withMethod("PUT").withPath("/studios/3e8370e7/start").withQueryStringParameter("workspaceId", "75887156211589")
+                        .withBody(json("""
+                           {
+                             "allowedUserIds": [7]
+                           }
+                           """, MatchType.ONLY_MATCHING_FIELDS))
+                , exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody(loadResource("studios/studios_start_response")).withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        ExecOut out = exec(format, mock, "studios", "start", "-w", "75887156211589", "-i", "3e8370e7", "--allow-user", "someuser");
+
+        assertOutput(format, out, new StudioStartSubmitted("3e8370e7", "3e8370e7",75887156211589L,
+                "[organization1 / workspace1]",  "http://localhost:"+mock.getPort()+"/orgs/organization1/workspaces/workspace1", true));
+    }
+
     @ParameterizedTest
     @EnumSource(OutputType.class)
     void testStartByName(OutputType format, MockServerClient mock) {
@@ -1310,6 +1469,140 @@ void testAddWithNonDefaultConfig(OutputType format, MockServerClient mock){
                 "http://localhost:"+mock.getPort()+"/orgs/organization1/workspaces/workspace1", false));
     }
 
+    @ParameterizedTest
+    @EnumSource(OutputType.class)
+    void testAddPrivateWithAllowedUser(OutputType format, MockServerClient mock){
+        mock.when(
+                request().withMethod("GET").withPath("/user-info"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody(loadResource("user")).withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        mock.when(
+                request().withMethod("GET").withPath("/user/1264/workspaces"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody(loadResource("workspaces/workspaces_list")).withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        mock.when(
+                request().withMethod("GET").withPath("/studios/templates")
+                        .withQueryStringParameter("workspaceId", "75887156211589")
+                        .withQueryStringParameter("max", "20"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody(loadResource("studios/studios_templates_response")).withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        mock.when(
+                request().withMethod("GET").withPath("/compute-envs")
+                        .withQueryStringParameter("status", "AVAILABLE")
+                        .withQueryStringParameter("workspaceId", "75887156211589"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody("{\"computeEnvs\":[{\"id\":\"vYOK4vn7spw7bHHWBDXZ2\",\"name\":\"demo\",\"platform\":\"aws-batch\",\"status\":\"AVAILABLE\",\"message\":null,\"lastUsed\":null,\"primary\":true,\"workspaceName\":null,\"visibility\":null}]}").withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        mock.when(
+                request().withMethod("GET").withPath("/compute-envs/vYOK4vn7spw7bHHWBDXZ2"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody(loadResource("compute_env_demo")).withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        // Assert only the allow-list fields are sent; the rest of the create body is covered by other tests.
+        mock.when(
+                request().withMethod("POST").withPath("/studios")
+                        .withQueryStringParameter("workspaceId", "75887156211589")
+                        .withQueryStringParameter("autostart", "false")
+                        .withBody(json("""
+                           {
+                             "isPrivate": true,
+                             "allowedUserIds": [21]
+                           }
+                           """, MatchType.ONLY_MATCHING_FIELDS))
+                , exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody(loadResource("studios/studios_created_response")).withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        ExecOut out = exec(format, mock, "studios", "add", "-n", "studio-a66d", "-w", "75887156211589", "-t" ,"cr.seqera.io/public/data-studio-vscode:1.93.1-snapshot", "-c", "demo",
+        "--private", "--allow-user", "21");
+
+        assertOutput(format, out, new StudiosCreated("3e8370e7",75887156211589L, "[organization1 / workspace1]",
+                "http://localhost:"+mock.getPort()+"/orgs/organization1/workspaces/workspace1", false));
+    }
+
+    @ParameterizedTest
+    @EnumSource(OutputType.class)
+    void testAddPrivateWithAllowedUserByEmail(OutputType format, MockServerClient mock){
+        mock.when(
+                request().withMethod("GET").withPath("/user-info"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody(loadResource("user")).withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        mock.when(
+                request().withMethod("GET").withPath("/user/1264/workspaces"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody(loadResource("workspaces/workspaces_list")).withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        mock.when(
+                request().withMethod("GET").withPath("/studios/templates")
+                        .withQueryStringParameter("workspaceId", "75887156211589")
+                        .withQueryStringParameter("max", "20"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody(loadResource("studios/studios_templates_response")).withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        mock.when(
+                request().withMethod("GET").withPath("/compute-envs")
+                        .withQueryStringParameter("status", "AVAILABLE")
+                        .withQueryStringParameter("workspaceId", "75887156211589"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody("{\"computeEnvs\":[{\"id\":\"vYOK4vn7spw7bHHWBDXZ2\",\"name\":\"demo\",\"platform\":\"aws-batch\",\"status\":\"AVAILABLE\",\"message\":null,\"lastUsed\":null,\"primary\":true,\"workspaceName\":null,\"visibility\":null}]}").withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        mock.when(
+                request().withMethod("GET").withPath("/compute-envs/vYOK4vn7spw7bHHWBDXZ2"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody(loadResource("compute_env_demo")).withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        // Resolution: the email is not a full member, so the resolver falls back to collaborators,
+        // where it finds the user (userId 21) — mirroring how a workspace collaborator is looked up.
+        mock.when(
+                request().withMethod("GET").withPath("/orgs/27736513644467/members"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody("{\"members\":[],\"totalSize\":0}").withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        mock.when(
+                request().withMethod("GET").withPath("/orgs/27736513644467/collaborators"), exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody("{\"members\":[{\"memberId\":255080245994226,\"userId\":21,\"userName\":\"nonowner\",\"email\":\"nonowner@seqera.io\",\"role\":\"collaborator\"}],\"totalSize\":1}").withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        // The resolved user id (21) is what gets sent in the request.
+        mock.when(
+                request().withMethod("POST").withPath("/studios")
+                        .withQueryStringParameter("workspaceId", "75887156211589")
+                        .withQueryStringParameter("autostart", "false")
+                        .withBody(json("""
+                           {
+                             "isPrivate": true,
+                             "allowedUserIds": [21]
+                           }
+                           """, MatchType.ONLY_MATCHING_FIELDS))
+                , exactly(1)
+        ).respond(
+                response().withStatusCode(200).withBody(loadResource("studios/studios_created_response")).withContentType(MediaType.APPLICATION_JSON)
+        );
+
+        ExecOut out = exec(format, mock, "studios", "add", "-n", "studio-a66d", "-w", "75887156211589", "-t" ,"cr.seqera.io/public/data-studio-vscode:1.93.1-snapshot", "-c", "demo",
+        "--private", "--allow-user", "nonowner@seqera.io");
+
+        assertOutput(format, out, new StudiosCreated("3e8370e7",75887156211589L, "[organization1 / workspace1]",
+                "http://localhost:"+mock.getPort()+"/orgs/organization1/workspaces/workspace1", false));
+    }
+
     @ParameterizedTest
     @EnumSource(OutputType.class)
     void testAddWithNonExistentLabel(OutputType format, MockServerClient mock){
diff --git a/src/test/resources/runcmd/studios/studios_view_response_with_allowed_users.json b/src/test/resources/runcmd/studios/studios_view_response_with_allowed_users.json
new file mode 100644
index 000000000..84d5a92e0
--- /dev/null
+++ b/src/test/resources/runcmd/studios/studios_view_response_with_allowed_users.json
@@ -0,0 +1,72 @@
+{
+  "sessionId": "3e8370e7",
+  "workspaceId": 75887156211589,
+  "user": {
+    "id": 2345,
+    "userName": "John Doe",
+    "email": "john@seqera.io",
+    "avatar": null
+  },
+  "allowedUsers": [
+    {
+      "id": 21,
+      "userName": "nonowner",
+      "email": "nonowner@seqera.io",
+      "avatar": null
+    }
+  ],
+  "name": "studio-a66d",
+  "description": "my first studio",
+  "studioUrl": "https://a3e8370e7.dev-tower.com",
+  "computeEnv": {
+    "id": "3xkkzYH2nbD3nZjrzKm0oR",
+    "name": "ce1",
+    "platform": "aws-batch",
+    "region": "us-east-2"
+  },
+  "template": {
+    "repository": "cr.seqera.io/public/data-studio-vscode:1.93.1-snapshot",
+    "icon": "vscode"
+  },
+  "configuration": {
+    "gpu": 0,
+    "cpu": 2,
+    "memory": 8192,
+    "mountData": [
+      "v1-user-1ccf131810375d303bf0402dd8423433"
+    ],
+    "condaEnvironment":null
+  },
+  "dateCreated": "2024-12-19T06:49:24.893122+01:00",
+  "lastUpdated": "2024-12-19T06:52:50.686822+01:00",
+  "statusInfo": {
+    "status": "running",
+    "message": "",
+    "lastUpdate": "2024-12-19T05:52:41.823Z"
+  },
+  "waveBuildUrl": null,
+  "baseImage": "cr.seqera.io/public/data-studio-jupyter:4.2.5-snapshot",
+  "isPrivate": true,
+  "mountedDataLinks": [
+    {
+      "id": "v1-user-1ccf131810375d303bf0402dd8423433",
+      "name": "aaa-my-bucket",
+      "resourceRef": "s3://aaa-my-bucket",
+      "type": "bucket",
+      "provider": "aws",
+      "region": "us-east-2"
+    }
+  ],
+  "progress": [
+    {
+      "status": "succeeded",
+      "message": "Provisioning compute resources",
+      "warnings": null
+    },
+    {
+      "status": "succeeded",
+      "message": "Mounting checkpoints",
+      "warnings": null
+    }
+  ]
+}