Work with your team

A team owns sites. Everyone on a team holds one role on all of its sites, and a guest holds a role on one site only. This page shows how to invite people, change what they can do, move sites between teams, look after your account, and manage API keys.

#How teams own sites

Every site belongs to exactly one team. A team member's role applies to every site of that team, including sites added after the person joined. A guest belongs to no team and sees only the site they were invited to.

You get your first team when you create an account. misomoon names it after you, for example "Ada's sites", and makes you its owner. An account made through an invitation starts without a team of its own. If that person adds a site and no team lets them add sites, misomoon creates a team named "My sites" with them as owner.

The Team tab in Settings always shows the team of the site that is open. To manage another team, open one of its sites first.

#What each role can do

A team role is one of five values. Each role grants a set of permissions from packages/core/src/roles.ts, and the API checks those permissions on every request.

A guest holds one of two roles on a single site:

If someone is both a team member and a guest on one of the team's sites, the team role applies.

These rules decide who can give which role:

• An owner can give, change, and take away any role, including owner.
• An admin can't invite an owner, make someone an owner, change an owner's role, or remove an owner.
• A team always keeps one owner. misomoon refuses to change the role of the last owner or to remove the last owner, and that includes the last owner leaving.
• Only owners and admins manage people, so only they see the Team tab.

#Who can sign up

The SIGNUPS variable decides who can create an account from the sign-in screen. Configuration lists it with the other variables.

Invitations create accounts under every value, including closed. The Create an account link on the sign-in screen appears only while sign-up is open. The deploy bundle sets invite, and Run misomoon in your Cloudflare account shows how to claim a new instance.

With closed and no account yet, nobody can sign in or send an invitation. Claim the instance before you set closed.

#Invite a teammate

You need the Owner or Admin role on the team.

1. Open a site of the team, and go to Settings > Team.
2. Enter the person's email address.
3. In Access to, keep Whole team.
4. In Role, pick the role. Admins don't see Owner in the list.
5. Select Invite.

The invitation link appears below the form, with a button to copy it. If the instance has an email provider, misomoon also emails the link, with the team name in the subject. Without an email provider, send the link yourself. The link works for 7 days. Configuration explains how to set up email.

The invitation stays in the member list as pending, with its expiry date, until the person accepts it. To withdraw it, select the trash icon next to it.

If you invite the same email address again, the new invitation replaces the old one, and the old link stops working. You can't invite someone who is already on the team.

#Give someone one site

To let someone see one site without joining the team, invite them as a guest. You need the Owner or Admin role on the site's team.

1. Open the site, and go to Settings > Team.
2. Enter the person's email address.
3. In Access to, pick Only followed by the site name.
4. In Role, pick Guest editor or Guest viewer.
5. Select Invite.

The link, the email, and the 7-day expiry work as they do for a team invitation. The Team tab lists the open site's guests with their role. To change a guest's role, pick another value in the menu next to their name. To remove a guest, select the trash icon next to their name.

#Accept an invitation

Open the link from the email or from the person who invited you. It looks like https://analytics.example.com/invite/mi_.... The page names who invited you, to which team or site, and with which role.

• If you have no account, enter your name and a password of at least 10 characters, and select Accept invitation. misomoon creates your account with the invited email address and signs you in.
• If you have an account and are signed out, select Sign in as followed by your email address. Enter your password, and select Sign in. misomoon accepts the invitation after you sign in.
• If you are signed in with the invited email address, select Accept invitation.

If you are signed in with a different email address, misomoon refuses the invitation. Sign out, and open the link again.

After you accept, the dashboard opens on the site you were invited to, or on the team's first site. If you were already a guest on that site, the role in the new invitation replaces your old one. An expired or withdrawn link shows an error, so ask for a new invitation.

#Change a role

You need the Owner or Admin role on the team.

1. Open a site of the team, and go to Settings > Team.
2. In the menu next to the person's name, pick the new role.

The change applies to every site of the team. An admin sees an owner's role as a plain Owner label, with no menu and no trash icon. To change the role of the last owner, make someone else an owner first.

#Remove someone

You need the Owner or Admin role on the team. Only an owner can remove an owner.

1. Open a site of the team, and go to Settings > Team.
2. Select the trash icon next to the person's name.

The person loses access to every site of the team at once. Their API keys stop working on those sites too, because a key acts with its owner's role.

#Leave a team

Every role except owner leaves from the Sites tab:

1. Open a site of the team, and go to Settings > Sites.
2. Select Leave team.

You lose access to every site of the team. A guest sees Leave site in the same place, and it ends their access to that one site.

The Sites tab has no leave button for an owner. If the team has another owner, go to Settings > Team, and select the trash icon on your own row. The last owner can't leave. Make someone else an owner first.

#Create another team

The dashboard has no button to create a team. Use the API with a browser session token. API keys can't call team routes.

1. Sign in through the API, and copy the token from the response:

   shCopy

   curl -X POST "https://analytics.example.com/api/v1/auth/login" \
    -H "Content-Type: application/json" \
    -d '{"email": "you@example.com", "password": "your password"}'

2. Create the team with that token:

   shCopy

   curl -X POST "https://analytics.example.com/api/v1/teams" \
    -H "Authorization: Bearer ms_..." -H "Content-Type: application/json" \
    -d '{"name": "Client work"}'

The response is the new team with "role": "owner". A name longer than 80 characters is cut to 80, and an empty name becomes "My team".

To put a site in the new team, add one from Settings > Sites. Select Change under the domain field, and pick the team in Team. That menu appears when you can add sites to more than one team. You can also move an existing site into the new team, as Move a site to another team describes. A team with no sites has no Team tab, because the tab follows the open site.

#Rename or delete a team

To rename a team, you need the Owner or Admin role.

1. Open a site of the team, and go to Settings > Team.
2. Edit the name at the top of the tab.
3. Select Rename.

To delete a team, you need the Owner role, and the team must have no sites. Move or delete its sites first. The dashboard has no button to delete a team, so send DELETE /api/v1/teams/:team with a session token. misomoon answers 204 when the team is gone, or 409 while the team still has sites.

#Move a site to another team

You need the Owner role on the site's current team, and the Owner or Admin role on the team that receives it.

1. Open the site, and go to Settings > Sites.
2. Under Danger zone, pick the receiving team in Team.
3. Select Move site.

The Team menu lists only the teams that you own or administer. If you have none, the move controls don't appear.

When the site moves:

• Members of the old team lose access, unless they are members of the new team too.
• Members of the new team get access with their team role.
• Guests keep their guest role. A guest who is a member of the new team stops being a guest, because the team role now covers the site.
• Pending invitations to the site are withdrawn.

The API call is POST /api/v1/sites/:id/transfer with {"team": "<team id>"}.

#Manage your account

Settings > Account shows the email address you signed in with and your role on the open site. You can't change your email address.

#Change your name or password

1. Go to Settings > Account.
2. Edit your name.
3. To change your password, enter your current password in Current password and the new one in New password.
4. Select Save.

A password has 10 to 200 characters. A name longer than 80 characters is cut to 80. Changing your password here keeps your other sessions signed in.

#Reset a forgotten password

The reset link goes out by email, so the instance needs an email provider.

1. On the sign-in screen, select Forgot your password?.
2. Enter your email address, and select Send the link.
3. Open the link in the email. The link works for one hour.
4. Enter a new password of at least 10 characters, and select Save and sign in.

The new password signs you out of every other browser and device. If you ask for a second link, the first one stops working. The screen answers the same way whether or not the email address has an account.

Without an email provider, the screen says that email isn't set up, and no link goes out. misomoon has no other way to reset a password from the dashboard or the API.

#Sign out

Select Sign out in Settings > Account. Signing out ends the session in that browser only.

A session starts each time you sign in and lasts 30 days. After that, the dashboard asks you to sign in again. To end every session at once, reset your password.

#Delete your account

1. Go to Settings > Account, and select Delete account….
2. Enter your password, and select Delete account.

misomoon deletes the account at once, and signs you out:

• A team where you are the only member is deleted, with its sites and all of their stats. Export what you want to keep first (Refresh and export).
• You leave every other team, and lose guest access to other teams' sites. Their sites and stats stay.
• Your sessions, API keys, saved segments, pending invitations to your email address, and the email reports sent to it are deleted.

If you are the only owner of a team that has other members, deleting fails with "you are the only owner of … make someone else owner or remove its members first". Make one of them an owner (Change a role), or remove them, and try again. A wrong password changes nothing.

On app.misomoon.com, backups that could still hold the deleted data expire within the time the data processing agreement gives.

#Manage API keys

An API key starts with mm_ and acts as you. Send it in the Authorization header, as API shows. To connect an AI tool with a key, see Ask AI tools about your traffic.

#Create an API key

To create a key for one site in the dashboard:

1. Open the site, and go to Settings > Integrations.
2. In Connect AI tools (MCP), select Create API key for followed by the site name.
3. Copy the key, or the command or JSON that contains it. misomoon shows the key only once.

The key is named "MCP · " followed by the site name, and it reads only that site. The create button appears only while you have no key for the site. After that, the section lists the key with a Rotate button.

To create a key for every site you can see, use the API with a session token. Leave out site:

curl -X POST "https://analytics.example.com/api/v1/keys" \
	-H "Authorization: Bearer ms_..." -H "Content-Type: application/json" \
	-d '{"name": "Nightly export"}'

To limit the key to one site, add "site": "<site id>". You need at least read access to that site. The response holds the key in key, and misomoon doesn't show it again. A name longer than 80 characters is cut to 80, and an empty name becomes "API key".

#Rotate an API key

Rotating gives a key a new secret. The name and the site stay. The old secret stops working at once, so update every tool that uses it.

1. Open the key's site, and go to Settings > Integrations.
2. Select Rotate next to the key, then Confirm rotate.
3. Copy the new key. misomoon shows it only once.

The dashboard rotates site keys only. For a key without a site, send POST /api/v1/keys/:key/rotate with a session token.

#Revoke an API key

1. Go to Settings > Account.
2. Under API keys, select the trash icon next to the key.

The list shows each key's first characters, its name, its site or "all your sites", and when it was last used. A revoked key stops working at once.

#What a key can do

• A key has your role on each site. If your role changes or you lose access, the key changes with you.
• A key can do everything your role allows on a site, including changes and deletes. A key that belongs to an owner or an admin can delete a site.
• A key with a site reads and changes that site only.
• The Stats API allows 100 requests per minute per key, as API describes.
• misomoon records when a key was last used, about once a minute while the key is busy.

Some calls need a signed-in person, and a key gets 403 for them. Sign in to the dashboard, or use a session token, to do these things:

• Change your name or password.
• List, create, rotate, or revoke API keys.
• Read or change teams, members, roles, and team invitations.
• Add a site.
• Move a site to another team.
• Save a personal segment.

#Limits on sign-in attempts

When the STATS_LIMIT binding exists, misomoon allows 100 attempts per minute per IP address for each of these actions: sign-up, sign-in, the forgotten-password form, the password reset, and the invitation accept. Over the limit, the action answers 429. Wait a minute, and try again.

#API routes for accounts and teams

Every route is under /api/v1. Routes that need a signed-in person refuse API keys. API lists the same routes with the rest of the API.

The dashboard guide, Use the dashboard, covers the rest of Settings. Links that let people outside the team read a site are in Share a dashboard.