Analytics
Access Controls & Audit Log
Give each teammate, agency, and script exactly the access it needs. Organization roles, per-project restrictions, scoped API keys, and an audit log of who changed what.
The team that touches your paywalls is bigger than your team. A growth marketer, an agency running experiments for one app, a finance analyst who needs the charts, a CI script that publishes a campaign at 2am. Access Controls let you give each of them the least they need, and the Audit Log shows what they did with it.
Roles that match how teams actually work
An organization role sets the most a member can do. Owners have full control including billing and other Owners. Admins have full working access but cannot touch the Owner role. Editors create and edit paywalls, campaigns, notifications, and assets but never see webhooks or billing. Readers see everything and change nothing. Analysts get read-only access to analytics and reporting, which is the role your finance and data stakeholders were missing.
-
Restrict members to projects. A member is either on All Projects or Restricted to a list you pick, with a project role of Admin, Editor, or Viewer on each one. An agency that runs one of your apps sees only that app.
-
Project roles never exceed the org role. A Reader with a project Admin grant is still read-only. The organization role is the ceiling; project access only narrows where it applies.
-
Only Owners and Admins manage access. A restricted Admin can manage access for the projects they can already reach, and cannot grant unrestricted organization access to anyone.
API keys with scopes, not god mode
Organization API keys use the same model. Pick the scopes a key needs,
such as paywalls:write, charts:read, or
data:read for the ClickHouse query API, then decide whether
it can operate across all projects or only selected ones. Both checks
must pass on every request. The token is shown once at creation, and the
key list records each key's scopes, project access, and last-used
timestamp so stale keys are easy to find and revoke.
The audit log
Every served request to the dashboard and the V2 API is recorded with the actor, the parsed action, the resource it touched, whether it was allowed or rejected, and the time. Filter by date range, action type, outcome, actor, HTTP method, endpoint, or failure code. Open an entry and you get the authentication method, session ID, device, IP address, and for supported writes a before-and-after list of what changed. "View this session" filters the log to everything else that login did.
Rejected requests are marked, which turns "why did my script get a 403?" into a one-click answer.
What you can do with it
- Give an agency Editor access to one project and nothing else.
- Hand finance an Analyst seat instead of a shared login.
- Issue a CI key that can only write campaigns in the staging project.
- Answer "who changed the annual price last Tuesday?" with the before and after values.
Get started
Open Settings, then Team, and click Invite member. Choose an organization role, then All Projects or Restricted. API keys live under Settings, then API Keys, with the same scope and project controls. The Team settings docs list what each role can and cannot do.