Your team, roles and logs

Each person on your team signs in with their own login and a role that matches their job. The audit log then records who changed what and when, in the dashboard or through the API, and the request log shows each API request and what we answered.

Invite your team

Open Team and select Invite member. Give everyone their own login rather than sharing one — a shared account makes the audit log useless, and removing one person means changing a password for everybody.

Roles let you give someone what their job needs and nothing more. Support does not need to change your pricing. Whoever chases payments does not need to add team members.

Remove access the day someone leaves. Their history stays in the audit log.

Roles

Team → Roles lists every role and how many permissions it has. A permission is one action on one kind of record, such as viewing invoices or managing the catalogue.

There are five fixed roles, which you cannot change: Owner, Admin, Manager, Ops and Developer. Select View permissions on one to see what it holds.

Create a custom role

When no fixed role fits, make your own.

A change to a role applies to each member with it on their next request. You cannot edit or delete the role you hold yourself, and you can delete a custom role only when no member has it.

API keys

API keys live under Developers → API keys. When you create a key, select:

Give each integration the least access it needs. A key that only reads invoices into your accounting tool needs no write access at all. As with roles, you cannot give a key more than you have yourself. Change it later with Edit access; the change applies to the key's next request.

The full secret shows once, when you create or rotate the key. Rotate creates a new key with the same name, mode and access, and The old key stops sets when the old one stops: Immediately, after 1 hour, after 24 hours or after 7 days. The overlap gives you time to deploy the new key. Revoke stops a key at once. The list shows when each key was last used.

The audit log

Audit Log records what changed, when, and who did it — at the business level and across the whole organization.

It covers changes your team makes in the dashboard and changes made through the API, so a single trail answers "who cancelled this subscription?" without anyone having to remember. Select Security to see only the sensitive changes: API keys, webhook endpoints, gateway accounts, integrations, mail settings, the team, two-factor settings and data exports.

Reach for it when:

• A customer says they were charged something nobody meant to charge them
• A price or a billing rule changed and nobody remembers agreeing to it
• You need to show, later, that something was done and by whom

The request log

Developers → Request logs shows each request your API keys made, reads and writes, and each change made in the dashboard: the status, the duration, the key or member, and the request and response bodies. Use it when a developer asks why a call failed.

• Secrets are hidden before we store a request: passwords, tokens, API keys, card numbers and gateway credentials. Very large bodies are cut to a preview.
• We keep writes for 90 days and reads for 30 days.
• Every API response has a Request-Id header, such as req_0a1b2c3d4e5f60718293a4b5c6d7e8f9. Search for it in the request log to find that exact request. Its page links to the events, audit entries and gateway calls it caused.
• Requests with an incorrect key or an unknown path are not in the log.

Select View requests on an API key to see only that key's requests.

Logs inside a business

Logs inside a business is the other half: what Two Minute Billing sent to your payment provider and what came back, including the failures.

Use the audit log for who did what, the request log for what your integration sent, and Logs for what the provider said. Between them, "why was this customer not charged?" is a question with an answer.

Related

• Security: roles, passkeys and the audit log
• API keys and authentication
• Custom roles and the request log in the API reference