Teams & access
One install is one organisation. People belong to it with a role, and members see the projects they are added to.
Roles
| Role | Can |
|---|---|
| Owner | Everything. One per install: the person who ran the setup wizard. Cannot be demoted. |
| Admin | See every project, manage members and invites, change roles, create projects, delete issues. |
| Member | See and triage issues in the projects they belong to. |
Invites
Settings → Members → Invite. Pick the role (admin or member) and, for members, which projects they join.
- With SMTP set up, the invite is emailed.
- Without it, copy the invite link and send it yourself.
- The link expires in 7 days. The invitee sets a password when they accept.
Signup is invite-only. There is no SSO in v1.
Admins can change a member’s role or remove them in Settings → Members.
Projects
Each project has its own DSN keys, platform, retention (default 90 days), in-app rules and webhooks. Manage them in Settings → Projects. A project can have more than one DSN key, so you can rotate one without downtime.
API tokens
Tokens are personal: a token can do what you can, never more.
Create one in Settings → API tokens:
- Scope:
readorwrite. Read tokens can list and fetch. Write tokens can also resolve, mute, assign, link fixes, change notification prefs and upload source maps. - Project: all your projects, or one. A project-scoped token only sees that project, even if you can see more.
- Label: so you know what to revoke later.
The token (of_…) is shown once. It is stored hashed. Revoke it any time in the same place.
Use it as a bearer token:
curl -H "Authorization: Bearer of_..." https://errors.example.com/api/v1/me
The same token works for the REST API, MCP and source map uploads. The iOS app gets its own write token when you pair it, tied to that device.
Sessions
Browser sessions last 30 days. Login attempts are rate limited per IP: more than 10 in 15 minutes and you have to wait.