Workspace
A workspace is the top-level container in Skene Cloud. It holds your lifecycle, tracking plans, tracking evidence, connections, and team members. Each workspace connects to one Supabase project and one GitHub repository.
Members and roles
Manage members from Settings → Members.
| Role | Permissions |
|---|---|
| Owner | Full access. Manage billing, members, connections, and the workspace itself. Creating API keys and Flows Reset Data are owner-only. |
| Member | Edit the lifecycle, run analyses, use the Agent, and create, edit, version, and verify tracking plans. Cannot manage billing, members, or connections. |
Inviting members
Click Invite member, enter an email address, and send the invitation. The invited user receives an email with a link to join the workspace.
Removing members
Click the remove button next to a member's name. This revokes their access immediately.
API keys
API keys authenticate external integrations and the skene CLI. Manage them from the API keys page.
Creating a key
Click Create key (owners only) and pick a key type. The new key appears once, in a "copy it now" dialog: copy it before you dismiss it. You can rename a key inline after creating it.
There are two key types, each scoped to the workspace:
| Key type | Prefix | What it can do | Rate limit |
|---|---|---|---|
| Secret key | sk-upstream- | All workspace APIs: push, chat completions, and management endpoints. Keep it server-side. | 100 req/min |
| Publishable key | sk-pub- | Write-only. Can only send events to the Flows ingest endpoint, so it's safe to embed in client-side code. | 300 req/min |
Using API keys
Secret keys authenticate requests to the workspace HTTP API (publishable keys work only against the ingest endpoint and are rejected everywhere else):
# CLI authentication
uvx skene login # Interactive login stores the key
uvx skene push # Uses stored key
# Direct API usage
curl -X POST https://www.skene.ai/api/v1/push \
-H "Authorization: Bearer sk-upstream-..." \
-H "Content-Type: application/json" \
-d '{"files": [{"path": "skene-context/engine.yaml", "content": "..."}]}'
Keys are accepted in three header formats:
Authorization: Bearer sk-upstream-...X-Skene-Token: sk-upstream-...X-API-Key: sk-upstream-...
Revoking a key
Click Revoke next to a key and confirm. This disables the key immediately. Anything authenticating with it will stop working.
Connections
The Integrations page (/workspace/<slug>/integrations, under Manage in the sidebar) shows every external connection in one place:
| Card | What it shows |
|---|---|
| Supabase | Connection status and access mode, with the project picker for OAuth connections. Once connected, an Analytics destination panel shows whether long-term event storage is set up, and links to the setup if it isn't. |
| GitHub | The linked repository, with the same controls as Settings. |
| PostHog / Mixpanel | Analytics sources: connect one and the journey reads its aggregate event counts to verify tracked steps (see below). |
The configuration forms for Supabase and GitHub live in Settings (each card links into the right tab):
| Tab | Purpose | Docs |
|---|---|---|
| Settings → Supabase | Database connection for schema grounding and lifecycle analysis | Supabase Integration |
| Settings → GitHub | Repository linking for codebase scans, skene-context/ sync, and PR reviews | GitHub Integration |
The Overview page shows connection status at a glance too, alongside a Tracking plans card (how many plans are ready, how many are missing events, with a link to the plans page) and attention items such as Tracking plans blocked and Tracking plans need verification.
Analytics sources
If your product already sends events to PostHog or Mixpanel, connect it as an analytics source on the Integrations page (workspace owners only):
- Click Connect PostHog or Connect Mixpanel.
- Enter the project credentials. PostHog takes a project ID, host, and a personal API key with Query Read permission. Mixpanel takes a project ID, data region, and a service account.
- Click Test and save. Skene runs a live query against the project first; if the test fails, nothing is stored.
Credentials are encrypted, used only for read-only aggregate queries, and never shown again after saving. Skene reads event counts for lifecycle steps on demand; it never copies your event data. Disconnect (owners only) stops the journey reading counts; reconnecting means entering credentials again.
Next steps
- Supabase Integration: Connect your database
- Lifecycle & Analysis: Run your first analysis
- skene CLI: Login: Authenticate the CLI with your API key
