> ## Documentation Index
> Fetch the complete documentation index at: https://docs.staminads.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Users & API Keys

> Manage team access and API credentials for your workspace

Control who has access to your workspace and manage API keys for programmatic access to your data.

## Team Members

Invite team members to collaborate on your workspace. Each member is assigned a role that determines their permissions.

<Frame>
  <img style={{ borderRadius: '0.5rem' }} src="https://mintcdn.com/staminads/E6ClmUvRjKDS4bnY/images/team.png?fit=max&auto=format&n=E6ClmUvRjKDS4bnY&q=85&s=8dafb8688720b1e21797c408bbd53326" alt="Team members list" width="1796" height="1122" data-path="images/team.png" />
</Frame>

### Roles

| Role       | Description                                                                               |
| ---------- | ----------------------------------------------------------------------------------------- |
| **Owner**  | Full control including billing and workspace deletion. Cannot be assigned via invitation. |
| **Admin**  | Manage members, settings, filters, and view all analytics                                 |
| **Editor** | Create and edit filters, annotations, and view analytics                                  |
| **Viewer** | Read-only access to reports and analytics                                                 |

### Inviting Members

1. Navigate to **Settings > Team**
2. Click **Invite Member**
3. Enter the email address and select a role
4. The invitee receives an email with a link to join

<Frame>
  <img style={{ borderRadius: '0.5rem' }} src="https://mintcdn.com/staminads/E6ClmUvRjKDS4bnY/images/invite_user.png?fit=max&auto=format&n=E6ClmUvRjKDS4bnY&q=85&s=f2275e6a799e5a3380b5f85a888dfa4e" alt="Invite member form" width="1294" height="812" data-path="images/invite_user.png" />
</Frame>

Invitations expire after 7 days. You can resend or revoke pending invitations from the Team settings page.

## API Keys

API keys allow programmatic access to Staminads for sending events, querying analytics, and managing workspace configuration.

<Frame>
  <img style={{ borderRadius: '0.5rem' }} src="https://mintcdn.com/staminads/E6ClmUvRjKDS4bnY/images/api_key_form.png?fit=max&auto=format&n=E6ClmUvRjKDS4bnY&q=85&s=518ba8d39051512692c5616c49e0b1ee" alt="API keys management" width="1528" height="1218" data-path="images/api_key_form.png" />
</Frame>

### Creating an API Key

1. Navigate to **Settings > API Keys**
2. Click **Create API Key**
3. Enter a name and optional description
4. Select the appropriate role (determines scopes)
5. Optionally set an expiration date
6. Copy the key immediately — it won't be shown again

<Warning>
  API keys are only displayed once at creation. Store them securely. If you lose a key, you'll need to create a new one.
</Warning>

### API Key Roles

| Role       | Description                       | Use Case                         |
| ---------- | --------------------------------- | -------------------------------- |
| **Admin**  | Full API access                   | Backend integrations, automation |
| **Editor** | Track events and manage analytics | SDK integration, data pipelines  |
| **Viewer** | Read-only analytics access        | Dashboards, reporting tools      |

### Scopes

Each role grants a specific set of scopes:

| Scope                | Description                         | Admin | Editor | Viewer |
| -------------------- | ----------------------------------- | :---: | :----: | :----: |
| `events.track`       | Send session and event data via SDK |   ✓   |    ✓   |        |
| `analytics.view`     | Query analytics data                |   ✓   |    ✓   |    ✓   |
| `analytics.export`   | Export analytics data               |   ✓   |    ✓   |        |
| `workspace.read`     | Read workspace configuration        |   ✓   |        |    ✓   |
| `filters.manage`     | Create and manage filters           |   ✓   |    ✓   |        |
| `annotations.manage` | Create and manage annotations       |   ✓   |    ✓   |        |

### Key Status

| Status      | Description                        |
| ----------- | ---------------------------------- |
| **Active**  | Key is valid and can be used       |
| **Expired** | Key has passed its expiration date |
| **Revoked** | Key was manually disabled          |

### Revoking Keys

To revoke an API key:

1. Navigate to **Settings > API Keys**
2. Find the key and click **Revoke**
3. Confirm the action

Revoked keys are immediately invalidated and cannot be restored.

<Tip>
  Create separate API keys for different environments (development, staging, production) and integrations. This makes it easy to rotate keys without affecting other systems.
</Tip>

## Security Best Practices

* **Use the minimum required role** — Don't use Admin keys when Viewer access is sufficient
* **Set expiration dates** — For temporary integrations, set keys to expire automatically
* **Rotate keys regularly** — Periodically create new keys and revoke old ones
* **Never commit keys to version control** — Use environment variables or secret managers
* **Monitor usage** — Check `last_used_at` to identify unused keys that should be revoked