# Team members and roles

> Invite teammates to a website as admins or viewers, transfer ownership, and rotate the site's secret key.

Source: https://metricraven.com/docs/team-members  
Markdown: https://metricraven.com/docs/team-members.md  
Section: Features

Invite the people you work with to a website. Each person signs in with their own account and gets a role on that website: owner, admin or viewer.

## Roles

| Role | Who |
| --- | --- |
| Owner | One per website: the person whose plan pays for it, usually whoever added it. Has full control. |
| Admin | Manages the website: settings, funnels, integrations, the share link, the secret key and the team. |
| Viewer | Sees every report, including visitor details, and changes nothing. |

| Action | Owner | Admin | Viewer |
| --- | --- | --- | --- |
| Traffic, revenue, goals, funnels and realtime reports | Yes | Yes | Yes |
| Visitor details: journeys, visitor explorer, customer names and emails | Yes | Yes | Yes |
| Change settings, exclusions, appearance, funnels, segments and chart notes | Yes | Yes | No |
| Connect Stripe, RevenueCat and Search Console | Yes | Yes | No |
| Manage the share link and rotate the secret key | Yes | Yes | No |
| Delete a person's data | Yes | Yes | No |
| Invite, resend, revoke, change roles, remove members | Yes | Yes, except the owner | No |
| Transfer ownership and manage billing | Yes | No | No |
| Leave the website | Transfer first | Yes | Yes |

Viewers see visitor details because they are people you invited by name, signed in with their own account. To show numbers without any personal data, use a [read-only share link](https://metricraven.com/docs/share-embed) instead.

## Invite someone

1. **Open Settings → Members**

   On the website's dashboard, open the Settings tab. Admins and the owner see the invite form.

2. **Enter their email and choose a role**

   They get an email with a link. You can also copy the link and send it yourself. The link works once and expires after 7 days.

3. **They accept**

   The link opens a page where they sign in, or create a free account, with the invited email address, then click **Accept invitation**. Only that address can accept, so a forwarded link is useless to anyone else.

Pending invitations are listed under the members. **Resend** sends a new link and restarts the 7 days; the previous link stops working. **Revoke** cancels the invitation.

## Change roles, remove and leave

Admins and the owner can switch anyone except the owner between admin and viewer, or remove them. Changes apply at once, including to that person's [access tokens](https://metricraven.com/docs/api-authentication#roles). Any member except the owner can leave a website from the same list.

To script this, use the [members API](https://metricraven.com/docs/account-api#members), the [CLI](https://metricraven.com/docs/cli-commands#changes) (`metricraven members …`) or the [MCP tools](https://metricraven.com/docs/mcp-tools#write-tools).

## Transfer ownership

The owner can make another member the owner from Settings → Members → **Transfer ownership**, by typing the website's name to confirm. The website's events then count toward the new owner's plan, and you stay on as an admin. If their plan has no room for another website or for its team, the transfer is refused until they upgrade.

## Plan limits

| Plan | Team members |
| --- | --- |
| Starter | 1 (you) |
| Growth | Up to 30 |
| Free trial | Up to 30 |

Team members are counted per owner, across all the websites you own: someone on three of your websites is one team member, and you count as one. Pending invitations count until they expire or are revoked. Share links and embeds are unlimited and never count. If you downgrade, nobody is removed; you can't invite more people until you're under the limit.

## Rotate your site key

The site secret key (`ana_sec_…`) lets your server send payments and events and read reports. Rotate it if it may have leaked, or when someone who had it leaves.

1. **Open Settings → Secret key**

   Admins and the owner see the current key's first characters, when it was created and when it was last used.

2. **Click Rotate key and choose what happens to the old key**

   **Stop it now** for a leaked key. **Keep it working for 24 hours** or **7 days** to give your servers time to switch.

3. **Copy the new key and deploy it**

   It is shown once. Put it in your server's environment and redeploy. The previous key's **Last used** time tells you when nothing sends it anymore; then click **Stop accepting previous keys now**, or let the grace period end.

## Named keys

Give each server or integration its own key with **Add a named key** in Settings → Secret keys (up to 10 besides the default key). Each one shows when it was last used, can be rolled with the same grace periods, and can be revoked on its own: requests with a revoked key fail with 401 at once. The default key can be rolled but not revoked. Keys can also be managed with the [API](https://metricraven.com/docs/site-api#secret-keys) and `metricraven websites keys` in the [CLI](https://metricraven.com/docs/cli-commands).

> **Warning:** After the grace period, requests with the old key fail with 401. The tracking script doesn't use the secret key, so pageviews keep coming in during a rotation.

## Details

- Only hashes of invitation links and secret keys are stored. A lost key can't be shown again: rotate it.
- Adding a website with **Add an existing site** and its current secret key makes you an admin of it. A previous key still in its grace period can't be used for this.
- Last-used times are updated at most every 5 minutes.
- Demo websites can't have team members.