# Organisations, projects and keys

> An organisation is your company or team. A project is one app or site inside it, with its own ingest keys, data and settings.

> **In short**
>
> - An organisation holds your members, roles, invitations, two-factor requirement and audit log. Roles apply to every project in it.
> - A project is one app or site. Every report shows one project at a time.
> - Each source has its own ingest key. Keys are public, so anyone who copies one can send data into your project.
> - To replace a key, rotate it, deploy the new key, then revoke the old one.
> - You can undo an archive but not a delete. A project delete permanently deletes the project's events within 14 days with the default schedule.

## What they are

An **organisation** is the company or team that owns your projects and members. It holds your members and their roles, [invitations](/docs/sign-up-and-invitations), the [two-factor requirement](/docs/two-factor-and-security) and the [audit log](/docs/audit-log).

A **project** is one app or site. It has its own ingest keys, its own data and its own settings. For example, the recording settings and the rubric are per project.

## When to create separate projects

Use one project for data that you want to analyse together. Use separate projects for production and staging, for unrelated products, and when settings must differ. See **Which data goes in which project** below.

Owners and admins can add a project in Settings → **Projects** → **New project**. The steps are in **Add a project: the steps** below.

## Environments

Every project has one of three labels: **production**, **staging** or **development**. The label changes one thing: the default for replay sampling. A production project starts at 100%. A staging or development project starts at 10%.

Sampling applies to replay only. Sequential does not sample analytics events.

## Sources and ingest keys

A **source** is the channel that data arrives through, for example PostHog or Session replay. Every new project gets one ingest key for each source. Keys look like `sq_posthog_…`. A key works only for its own source.

Each tab of the install snippet on **Setup** already contains the right key. The exception is **Pendo**. See [Install Sequential](/docs/install).

> **Ingest keys are public**
>
> Keys ship in your site's HTML or your app, like any analytics key. Unless your project has a list of allowed origins, Sequential does not check which site or app a key comes from. So anyone who copies a key can send data into your project.
>
> If that happens, rotate the key, then revoke the old one. The new key is also in your page, so someone can copy it too. Rotation stops only the copy that you found.
>
> **Allowed origins.** A project can have a list of allowed origins, such as `https://app.example.com`. Then Sequential refuses data that a browser sends from any other site, with 403 `origin_not_allowed`.
>
> - An origin is the scheme, the host and the port. The list takes exact origins only, with no wildcard and no path.
> - Sequential reads the browser's `Origin` header. When there is none, it reads the origin of the `Referer`.
> - It also refuses `Origin: null`. A browser sends it from a sandboxed iframe, a `data:` page and some privacy modes.
> - It allows a request with no `Origin` and no `Referer`, for example from a server, `curl` or a mobile SDK. So the list stops other websites from using your key in their visitors' browsers. It does not stop a script or a server, which can send any origin.
> - The check applies to every request that sends data, not to the requests that read settings.
> - The Sequential SDK stops sending after a 403 `origin_not_allowed`, for the rest of that page load, and writes one warning to the console. The next page load tries again.
> - If Sequential cannot read the list, it refuses the data with 503 `config_unavailable` and `Retry-After: 30`. It never treats an unreadable list as empty.
> - The list is empty by default, and an empty list allows every origin.
>
> **Set the allowed websites.** Open Settings → Projects → your project → **Sources & keys**. The **Allowed websites** card is under the keys.
>
> 1. In **Sites (one per line)**, type each site that runs your snippet, for example `https://shop.example.com`.
> 2. Under the box, the card shows the sites that the list would refuse, judged on the events of the last 7 days: "Would be refused, judged on the last 7 days". If none, it says "Nothing from the last 7 days would be refused."
> 3. Click **Save**. If the list refuses sites that sent events in the last 7 days, the card asks "Refuse events from these sites?" and names them. Click **Save and refuse them**, or **Cancel**.
> 4. The card says "Allowed websites saved. They apply to new events within a minute".
>
> - Each line must be an origin only. For a line with a path, or with a slash at the end, the card says "Use the origin only." and "Did you mean …?" with the origin. For a wildcard, it says "Wildcards are not allowed. List each site." For other text, it says "Must be an origin like https://shop.example.com." It ignores empty lines and lines that repeat.
> - The list takes at most 200 sites.
> - The check before you save reads the page addresses of the events of the last 7 days. It checks the 50 sites with the most events, and says how many more sites it did not check. Pages with no web address, such as `file:`, `data:` and `about:` pages, are refused by any list. Events with no page address, for example from a server or a mobile app, are not affected, and the card says how many there were.
> - To remove the list, delete all the lines and click **Save**. The card says "List cleared. Any website can send events again within a minute".
> - Only owners and admins can change the list. Other roles see the list, or "No list: any website can send events with this project's key.", and "Owners and admins can change this list."
> - If someone else saved the project's settings after you opened the page, the card names them, and **Reload** shows their version.
> - Sequential saves the whole settings document with only the list changed. Your audit log records the change.

## Rotate or revoke a key

Keys are under Settings → Projects → your project → **Sources & keys**. Members can copy keys. Owners and admins can also rotate and revoke them.

### Replace a key without losing data

1. Click **Rotate** next to the key. Both keys work until you revoke the old key.
2. Copy the new key from **Sources & keys** and deploy it.
3. When your app sends data with the new key, click **Revoke old key**.

### Revoke a key now

Click **Revoke** → **Revoke key**. Revoking is permanent. Sequential refuses anything sent with the key from then on. So an app that still uses the key loses data until it ships a new key.

Always keep one live Session replay key. The Sequential SDK and Smartlook fetch this key themselves. If you revoke the only one, their replay stops and Sequential shows no warning.

## Pendo API keys

If you use Pendo, owners and admins must register your own Pendo API key. A Pendo API key registers to one project only, so production and staging need different keys.

Do not click **Rotate** on a registered Pendo API key. Revoking one is permanent: you can never register a revoked Pendo API key again. See **Pendo API keys: before you change one** below.

## Archive or delete

If you can, archive the project instead of deleting it.

| | Archive | Delete |
|---|---|---|
| Undo | **Restore project**. The same keys work again. | None |
| Keys | Refused | Removed |
| Events, and the user, session and account records | Kept. Browse them again after you restore the project. | Unavailable at once. Permanently deleted within 14 days with the default schedule |
| Other stored data, such as judgments and identity links | Kept | Unavailable at once. Permanently deleted with the events |
| Recording files | Kept | Unreadable at once, because Sequential deletes their encryption keys. The storage deletes them later |
| Recording settings and rubric | Kept | Removed |

> **What a delete removes**
>
> Deleting a project permanently deletes its events, and the user, session and account records built from them, within 14 days with the default schedule. Judgments and identity links are deleted too. Recordings become unreadable at once, because Sequential deletes their encryption keys. The storage deletes the recording files later. See [Retention and deletion](/docs/retention-and-deletion).
>
> Deleting an organisation deletes each of its projects in the same way. Deleting an organisation also deletes its audit log.

## Limits

- Roles belong to the organisation. There are no per-project roles. So a project does not limit who in your organisation can see its data. See [Roles and permissions](/docs/roles-and-permissions).
- Sequential staff can also make support changes to a project: change its settings, archive or restore it, and revoke its keys and access tokens. The audit log names them "Sequential support". It never shows the name of the staff member. See [Changes by Sequential support](/docs/audit-log#changes-by-sequential-support).
- You cannot undo a project delete.
- **Recent changes** leaves out key changes. See the [Audit log](/docs/audit-log).
- The **Usage** card, on **Overview** and on the **Organisation** page, shows the sessions of the organisation when the server counts them and you can read the usage (owners, admins and members). Otherwise it says "Sessions and events this month will appear here — available with limits." See [Usage and limits](/docs/usage-and-limits).
- If you archive an organisation's last live project, the organisation leaves the switcher. Bookmark the project's settings page first, so you can restore it.
- If you change a project's environment later, Sequential does not change its replay sampling. Change sampling in Session replay → Sampling.
- The Used note on a key does not show that events arrive. To check for events, use Setup.

### Add a project: the steps

1. Go to Settings → **Projects** and click **New project**.
2. Enter a **Name** and pick an **Environment**.
3. Click **Create project**.
4. Click the new project in the list and open **Setup**. The **Setup** tab shows the install snippet.

Creating a project does not switch you to it. To see its data, pick it in the project switcher.

### Which data goes in which project

Put data that you want to analyse together in one project. Give data that you want to keep apart its own project.

| Situation | Suggestion |
|---|---|
| Production and staging of the same app | Separate projects. Test traffic stays out of your production reports, and staging records less replay by default. |
| Your app and a marketing site that you report on together | One project |
| Two unrelated products | Separate projects |
| Settings that must differ, for example console text captured in staging but not in production | Separate projects. Recording settings and the rubric are per project. |

### Sampling defaults and later changes

- A staging or development project records about one session in ten.
- Sequential applies the sampling default once, at creation. These values are defaults only.
- You can change the environment later in **Danger** → **Project details**, then click **Save**. This changes the label, never the sampling. If you open another page before you save, a bar asks "You have unsaved changes in Project details. Leave without saving?"
- To see your project's own value, go to Settings → Projects → your project → **Session replay** → **Sampling**. Owners and admins can change it there. See [Recording settings](/docs/recording-settings).
- Onboarding always creates a production project. To create staging and development projects, use **New project**.
- The environment does not separate data inside a project. For that, use separate projects.

### What a key can and cannot do

- A key can send data into its project.
- A key can read the project's recording settings.
- A key cannot read your analytics.
- A key is not a login or API credential.

### Which key each install uses

The sources are Sequential, PostHog, Mixpanel, Amplitude, Pendo, Smartlook and Session replay.

Sequential refuses a key that it gets from a different source, even when the key belongs to your project. For example, Sequential refuses a Session replay key in a PostHog setup. It also refuses a PostHog key that arrives at Mixpanel's endpoint.

| You install | Key it uses |
|---|---|
| Sequential SDK | Sequential. It fetches the replay key itself. |
| PostHog, Mixpanel or Amplitude on the web | That source's key. The optional replay line uses the Session replay key. |
| PostHog's mobile SDKs | PostHog, for events and replay |
| Smartlook | Smartlook. Replay starts on its own with the project's replay key. |
| Pendo | Your own Pendo API key, registered with the project. The optional replay line uses the Session replay key. |
| Session replay on its own | Session replay |

### Rotation edge cases

- When you revoke a key, every Sequential server stops accepting it at once. If Sequential cannot tell its other servers, for example because Redis is down, another server can accept the key for up to a minute.
- To keep both keys working after you rotate, click **Keep both**.
- The **Old key** mark and **Revoke old key** show only while the page stays open. If you left the page, revoke the old key with **Revoke** → **Revoke key**.
- The page lists live keys newest first. After you click **Rotate**, a new key appears above the old key. The new key has the label "rotated" and today's date. The old key shows **Old key**.
- Until you revoke the old key, **Setup** still shows the old key.
- Owners and admins see **Create key** when a source has no live key.
- If you use the Sequential SDK or Smartlook and rotate the **Session replay** key, there is nothing to deploy. Sequential gives them the project's oldest live replay key. So they keep using the old key until you revoke it.
- After you revoke it, new page loads switch to the new key within about a minute. Pages that are already open keep sending with the old key, and Sequential refuses it.
- The **Used …** note on a key also updates when a recorder fetches its settings. So the note shows only that something uses the key. It does not show that events arrive. To check for events, use **Setup**.

### Pendo API keys: before you change one

Pendo's agent sends data with your own Pendo API key. So owners and admins must register that key with the project. Before you change a registered Pendo API key:

- You can register a Pendo API key to one project only. So production and staging projects need different Pendo API keys.
- Do not click **Rotate** on your registered Pendo API key. Pendo never sends the new key.
- Revoke a registered Pendo API key only when you are sure. You can never register a revoked Pendo API key again.

### Register your Pendo API key

Owners and admins can register a Pendo API key.

1. Open the project's **Setup** tab.
2. In the **Install** card, pick **Pendo**.
3. Under **Register your Pendo API key**, paste the `apiKey` from your Pendo snippet.
4. Click **Register**.
5. Finish the steps in [Pendo](/docs/pendo).

The **Pendo** tab of the install snippet on **Setup** shows your Pendo API key only after you register it.

### When the Pendo tab is missing

The **Pendo** tab appears only while the project has a live Pendo key. If you revoked the Pendo ingest key that Sequential created with the project, use **Create key** under Pendo on **Sources & keys** to bring it back.

### Tabs and who sees them

To open a project's settings, click **Project settings** in the project switcher. You can also open them from Settings → **Projects**.

| Tab | What it is for | Who sees it |
|---|---|---|
| **Overview** | Three questions, each with a one-word answer: **Is data arriving?**, **Is judging working?** and **Is an agent connected?**. Then **Usage**, and **Recent changes**, the project's last 10 audit entries as sentences. See **The Overview tab** below. | Everyone. **Recent changes**: owners and admins. |
| **Setup** | Whether each source is receiving. The install snippet and **Install with your AI agent**. | Everyone. Snippet and **Install with your AI agent**: members, admins and owners. |
| **Sources & keys** | Every key, with copy, rotate and revoke, and the **Allowed websites** card | Members, admins and owners |
| **Insights**, **Calibration**, **Session replay** | The [rubric](/docs/rubric), how well its answers match reality ([calibration](/docs/feedback-and-calibration)), and [recording settings](/docs/recording-settings) | Everyone |
| **Danger** | Rename, change environment, archive, delete | Owners and admins |

On **Setup**, **Sequential** and **Session replay** always show whether they are receiving. Another source shows only after its first event, as on **Overview**. For example: "PostHog · receiving · 2 min ago". A line says "receiving", with a green dot, only when the last event is from the last 7 days, the same window as **Is data arriving?** on **Overview**. An older last event shows a dot that is not green and, for example, "PostHog · last event 12 d ago". To confirm a new install, see [Check your install](/docs/verify).

### The Overview tab

From 11 October 2026, the **Overview** tab answers three questions first. Each card shows the question, a one-word answer and, when needed, a short note.

| Card | The answer | What else it shows |
|---|---|---|
| **Is data arriving?** | **Yes**: the newest event or recording is at most 7 days old. **Not lately**: it is older. The note says when the last event arrived. **Not yet**: no event has arrived. The note points to the **Setup** tab. | One line for each source: **Sequential** and **Session replay** always, another source only after it has sent events. The sessions in 7 days, and when a key was last used. |
| **Is judging working?** | **Yes**: Sequential judged a session in the last 7 days. **Waiting**: sessions wait to be judged. **Not yet**: no session in the last 7 days is judged. **Off**: background judging is off. The note gives the reason. When the server has no AI key, or the server runs no background judging, the card says "Only whoever runs your Sequential server can change this." It then shows **Why judging is off**, not **Insights settings**. | "Judged N · N pending · last 7 days", the rubric version, and how much of the daily background-judging allowance is used, with the time it starts again. **Insights settings**. |
| **Is an agent connected?** | **Yes**: the project has a live access token or connection. **Not yet**: it has none. | Owners and admins see each live connection, with its name, the last 4 characters of a token and its last call, and **Manage access tokens**. |

- **Unknown** means that Sequential cannot tell. It never means No.
- Each card reads its answer by itself. If a read fails, the card shows the message and **Try again**. The other cards still show.
- The name, slug, environment and **Archived** are in the settings header above the tabs. The tab has no card for them.
- The judging card never shows a model, a price or a token count. It shows only the share of the allowance that is used.

### Archive, restore or delete: the steps

### Archive a project

1. Open **Danger** → **Archive project**.
2. Click **Archive**. The project leaves the switcher and moves to the **Archived** group on Settings → Projects.

### Restore a project

1. Open the project in the **Archived** group on Settings → Projects.
2. Go to **Danger** and click **Restore project**.

### Delete a project

1. Open **Danger** → **Delete project**.
2. Type the project's slug in **Project slug**. The page shows the slug, for example "Type `web-shop` to confirm.", with a **Copy** button next to it.
3. Click **Delete project**. It stays unavailable until the text matches exactly. A space at the end does not match.

### Archiving when you belong to more than one organisation

If you archive an organisation's last live project, that organisation leaves the switcher. Settings → Projects then shows another organisation's projects.

Bookmark the project's settings page before you archive it. Then you can restore the project from there.

### Deleting an organisation

The person who creates an organisation becomes its owner. Only owners can delete an organisation. Go to Settings → **Organisation** → **Delete organisation**. This removes the organisation's projects and keys. It deletes each project's data in the same way as a project delete. It deletes the organisation's audit log.

### The project switcher

Every report, funnel and replay list shows one project at a time. This is the project that you pick in the project switcher. The top row of the left rail shows the project that you are looking at. Click it to switch. When you pick a project, every page switches at once.

- The switcher groups projects by organisation and shows your role in each. A tick marks the current project.
- **Project settings** opens the current project's settings. **All projects** opens Settings → Projects.
- Sequential remembers your choice in this browser only. It forgets the choice when you sign out.
- If you belong to more than one organisation, a tile with the organisation's initials appears. Hover over the tile to see the name.
- Settings → Projects lists only the current organisation's projects. To manage another organisation's projects, first switch to one of its projects.
- You cannot pick an organisation that has no live projects.

## Related

- [Roles and permissions](/docs/roles-and-permissions)
- [Sign-up and invitations](/docs/sign-up-and-invitations)
- [Install Sequential](/docs/install)
- [Check your install](/docs/verify)
- [Pendo](/docs/pendo)
- [Recording settings](/docs/recording-settings)
- [Retention and deletion](/docs/retention-and-deletion)
- [Audit log](/docs/audit-log)