Organizations, projects and keys
Organizations
An organization is the billing and access boundary: a company or an agency. It has members, secret keys, ad-platform connections (optional, see Composio setup) and any number of projects. A user can belong to several organizations and switch between them in the dashboard (⌘K).
Projects
A project is one website or a group of sites that should be analysed together – for example
example.com, www.example.com and shop.example.com. Every analytics row belongs to exactly one
project; nothing is ever shared across projects. A project has:
| Setting | Meaning |
|---|---|
| Domains | Own hosts (example.com, *.example.com). Pageviews from other hosts are dropped; referrers from own hosts count as direct. |
| Allowed origins | Browser origins that may send events with the project's publishable keys (default: https:// + each domain). |
| Time zone | Day boundaries, daily salts and charts use it – never UTC implicitly. Changing it re-buckets the daily rollups of every day within the raw-data retention in the background; older rollup-only days keep the previous zone. |
| Currency, locale, country | Reporting currency for ad costs and conversion values; dashboard language default; calling code used to normalize national phone numbers in identify(). |
| Retention | Days raw tracking data is kept (default 180, 1–3650). |
| Tracking config | Page groups, excluded paths, personal paths, consent mode, CTA selectors, booking adapters, plugins … (Data attributes, Consent). |
| Preset | default for new sites; cpi reproduces the CPI Technologies setup 1:1 (Migrating from cpi-website2). |
All hosts of a project stitch sessions together: a visitor moving from example.com to
shop.example.com on the same day stays one visitor.
Members and roles
| Role | Typical use | Highlights |
|---|---|---|
owner | Founders, account owners | Everything, including personal data; only owners make owners. The last owner cannot be removed. |
admin | Marketing ops, agencies | Everything except making owners; personal data only with the pii permission. |
analyst | Analysts | Read everything, edit goals, funnels, relevance and event schemas. |
viewer | Stakeholders | Read analytics and ad costs. |
The pii permission (personal data) is a separate checkbox per member: without it a member never
sees leads, even as admin. The exact scope matrix is in Scopes and roles.
Sensitive actions (creating keys, connecting ad accounts, editing conversion destinations, deleting projects) need a recent re-authentication – sudo mode, valid for 15 minutes.
Credentials
| Credential | Prefix | Where it lives | What it can do |
|---|---|---|---|
| Publishable key | pk_3x_… | In your page (public) | Send events and read the public client config of one project, only from allowed origins. |
| Secret key | sk_3x_… | Your server, CI, Claude Code | REST API and MCP with the scopes you chose, optionally limited to some projects. Shown once. |
| Proxy key | sk_3x_… with only ingest:proxy | Your server (first-party proxy) | Lets the proxy forward the visitor's IP and country. Nothing else. |
| User session | x3s_… | Dashboard cookie | What the member's role allows. |
| OAuth token | x3oat_… | Claude (connector or Claude Code) | MCP only; scopes chosen on the consent page, intersected with the member's live role. |
Keys carry a checksum, so secret scanners can recognise leaked sk_3x_ keys offline. Details,
rotation and revocation: Authentication and keys.
Typical layouts
- One company, one site: one organization, one project.
- One company, landing pages on subdomains: one project with
*.example.com; page groups per landing page (/cto,/software) give each its own dashboard tab. - Agency: one organization per client, or one agency organization with one project per client and members restricted with project-narrowed keys. Ad accounts can be connected once at the organization level and selected per project.