Teams, SSO, and passkeys

Most of what I write about here is the analytics itself, but a chunk of the last stretch went into the less glamorous layer: getting more than one person into a workspace safely, and getting them out again when they leave. Here's where that stands.

Teams and roles

Workspaces are organized into teams, and members carry one of five roles with a deliberately small permission matrix:

• Lead — can invite and remove members, create and edit sites, delete sites.
• Maintainer — creates, edits, and deletes sites, but doesn't manage people.
• Developer and Analyst — create and edit sites, no deletion.
• Viewer — dashboards only.

Organization owners and admins sit above this and can manage teams regardless of team role. I resisted per-dashboard permissions or custom role builders; five roles cover the actual shapes of "who should touch what," and every role you add is a support burden you keep forever.

Invitations work how you'd hope: pending invites are listed with resend and revoke controls, invitation emails are queued rather than sent inline so a slow mail provider never blocks the request, and pending invites count toward seat limits — so stale invites are worth cleaning up before a hiring spree.

Signing in, from password to passkey

The baseline is unexciting on purpose: email and password, optional GitHub or Google OAuth, and TOTP two-factor with recovery codes managed under Account → Security.

The newer part is passkeys. Tracely supports WebAuthn end to end: you register a passkey from the security page, and the login page can authenticate against it — the browser does an options/verify exchange with the server (/login/webauthn/options, then /login/webauthn/verify) and you're in, no password typed. Passkeys are the rare security upgrade that's also a UX upgrade, and for an analytics account that often stays logged in on shared dashboards-on-TVs and the like, phishing-resistant sign-in matters more than people assume.

Enterprise SSO

For organizations that live in an identity provider, Tracely speaks both protocols that matter:

SAML. Each organization gets its own endpoints — a login route, an ACS callback, and a metadata URL at /auth/saml/{organization}/metadata that you hand to Okta, Entra, or whatever the IdP is. Metadata exchange means the setup is mostly copy-paste rather than certificate archaeology.

OIDC. Same per-organization shape: a redirect route and a callback at /auth/oidc/{organization}/callback for IdPs that prefer OpenID Connect.

Scoping SSO per organization rather than per deployment means one Tracely instance can serve multiple companies, each federated to its own IdP, without the configurations touching.

SCIM, or: the leaver problem

SSO gets people in the door; the harder half of enterprise identity is the leaver. When someone exits the company, their analytics access should die with their directory account — not whenever someone remembers.

Tracely ships a deliberately minimal SCIM 2.0 implementation for exactly this joiner/leaver automation: a /scim/v2/Users endpoint the IdP can list, create against, and delete from, plus a read-only /scim/v2/Groups. Provisioning a user creates the account and attaches it to the organization; deprovisioning detaches it. It's authenticated with its own token middleware and gated as a plan capability. I skipped the long tail of the SCIM spec — PATCH choreography, filtering syntax, group writes — because the 20% that automates onboarding and offboarding is the part that stops a real security hole.

Why this layer exists in a small product

Partly because analytics is a team sport — the person who reads the publication desk is rarely the person who configured the tracker. And partly because procurement is real: if a privacy-first tool wants to displace incumbents inside companies, it has to pass the identity-and-access checklist, not just the ethics one. That's also why there's a trust page aimed at exactly those reviews.

None of this changes anything about the analytics side — visitor data stays aggregate-first regardless of how many teammates are looking at it. This layer is only about the humans on the dashboard side of the glass.