A GraphJSON workspace is the ownership boundary for its API key, collections, dashboards, SQL queries, alerts, integrations, billing, and team access. Choose that boundary deliberately: a workspace usually represents a company, product, or isolated environment rather than an individual project inside a shared production account.
Personal and team workspaces#
Your account can belong to more than one workspace. Use the workspace switcher in the application navigation to move between them; the active workspace determines which data and resources you see.
A personal workspace is useful for evaluation. Create a team workspace when other people need durable access or when company billing and production data should not depend on one person’s account.
For strict separation between production and non-production, create separate workspaces. Each receives a different API key and its own data plane. Read Environments and instrumentation testing before choosing between workspace and collection-level separation.
Create a team workspace#
From the workspace switcher:
- Choose the option to create a team.
- Enter a recognizable company or product name.
- Switch into the new workspace.
- Copy its API key into your server-side secret manager.
- Send a test event and verify that it appears in the intended workspace.
API keys belong to workspaces, not individual users. Never place a key in browser code, a mobile application, a public repository, or a support message.
Invite teammates#
Open the team settings for the active workspace and invite people by email. Use company-managed addresses so access follows your organization’s identity and offboarding processes.
Everyone with workspace access can work with the workspace’s analytics resources. GraphJSON does not currently document fine-grained, resource-level roles, so do not use a shared workspace as the only separation between teams that must not see each other’s data.
Review membership on a regular schedule and after organizational changes. For member removal or an access change that is not available in the interface, contact hi@graphjson.com from an address associated with the workspace.
Secure individual accounts#
Every teammate should:
- use a unique password stored in a password manager
- enable SMS two-factor authentication in account settings
- avoid sharing a GraphJSON login
- sign out on untrusted or shared devices
- keep recovery information current
Shared accounts make access reviews and incident investigations much harder. Invite each person individually.
Operate API keys safely#
Treat the workspace API key as a production secret with write access to that workspace.
- store it in a deployment secret manager
- inject it only into server-side processes
- redact it from logs and error-reporting tools
- keep separate values for production and non-production workspaces
- limit who can read the underlying secret
If a key may have been exposed, stop the leak, identify affected deployments and logs, and contact hi@graphjson.com for replacement guidance. Plan the rollout so every legitimate sender moves to the new value and old queues cannot continue using the compromised one.
The full security model is covered in API keys and security.
Build an offboarding runbook#
When a teammate leaves or no longer needs access:
- remove or request removal of their workspace membership
- revoke access to deployment secrets and source repositories
- review dashboards, alerts, and external embeds they created
- transfer any operational ownership
- replace shared credentials if exposure cannot be ruled out
- record completion in your company’s access-review system
Removing a GraphJSON login does not remove an API key already copied into another system. Credential inventory and membership review are separate controls.
Assign operational ownership#
Each production workspace should have at least two current owners inside your organization and a written record of:
- the primary product and engineering contacts
- the billing contact
- where API keys are stored
- which services send events
- which collections have retention configured
- which embeds are customer-facing
- the escalation path for security or data-removal requests
Avoid making one employee’s inbox the only route to production analytics. A small amount of ownership documentation prevents avoidable lockouts and stale access.
Launch checklist#
- Production data lives in a company-controlled team workspace.
- At least two current teammates can administer the integration.
- Every person uses an individual login with two-factor authentication.
- API keys exist only in server-side secret stores.
- Production and non-production use an intentional isolation model.
- Membership and secret access are reviewed periodically.
- Offboarding, credential exposure, and billing ownership have named runbooks.
Use Account security and recovery for password, SMS two-factor authentication, lost-phone, and suspected-compromise procedures.
Once the workspace is ready, continue with the production-readiness checklist.