Manage users and API keys

Open settings with the cog icon in the bottom bar. Settings covers your own account, your company, your users, API keys and the audit log.

Signed in as

The top card shows who you are signed in as, your role and your client ID key. Sign out signs you out of this browser.

Company

The company card shows your company name and its master keys. The master keys are not API keys: the API and MCP do not accept them. Only an owner can see them, and Rotate master keys replaces them if they may have been exposed.

Users and roles

The Users list shows everyone in your organisation and their role:

• Owner, full control, including other owners and the company master keys;
• Admin, can add users and manage most settings;
• User, can work with projects, versions and quotes.

Click Add user to invite someone. Their own API keys are created for them, and they use those keys to sign in.

API keys

The Auth: global API keys card shows the client_id_key and client_secret_key used to authenticate API calls and to sign in AI clients over MCP. Keep them secret.

Rotate keys issues a new pair and stops the old pair working immediately. Update any systems that use the old keys straight away.

Audit log

The Audit log lists every action with the user and time, including versions created, approved, published and unpublished. Search by user or action, and choose a time range. Use it for internal reviews and as evidence of who changed what and when.