Overview
Adding users to PostHog involves inviting them to your organization, assigning an organization role, and granting access to specific projects. The process is straightforward but requires careful consideration of permissions to maintain security while enabling productivity.
This guide covers both PostHog Cloud and self-hosted deployments.
Before You Start
Confirm you have permission:
- Organization Owner or Admin role required
- Verify in Settings → Organization → Members
Gather information:
- User's email address
- Intended organization role (Member recommended by default)
- Which projects they need access to
- Project-level role for each project (Member, Admin, or Viewer)
Plan their access level:
Example:
Name: Jane Doe
Email: jane@example.com
Role: Member (organization)
Projects:
- Production (Viewer)
- Staging (Member)
- Development (Member)
Adding Users to PostHog Cloud
Step 1: Navigate to Organization Settings
- Log in to PostHog at app.posthog.com (or eu.posthog.com)
- Click your profile icon (bottom left)
- Select Settings
- Navigate to Organization → Members
Step 2: Invite User to Organization
- Click Invite member button
- Enter user's email address
- Select organization role:
- Member (recommended default) - Project access only
- Admin - Can create projects and invite users
- Owner - Full organization control, billing access
- Click Invite member
Email invitation sent:
- User receives email invitation
- Valid for 3 days
- Can be resent if expired
Step 3: Grant Project Access
After invitation is accepted (or while setting up):
- Go to Settings → Project (select project from dropdown)
- Navigate to Members
- Click Add member to project
- Select the user from organization members
- Choose project role:
- Admin - Full project control
- Member - Create insights, dashboards, feature flags
- Viewer - Read-only access
- Click Add member
Repeat for each project the user needs access to.
Step 4: Verify Access
- Confirm user appears in Organization → Members
- Check each project's member list
- Ask user to log in and verify they can see intended projects
- Test that permissions work as expected
Adding Users to Self-Hosted PostHog
Method 1: Email Invitation (Requires Email Configuration)
If email is configured on your self-hosted instance:
- Log in to your PostHog instance
- Navigate to Settings → Organization → Members
- Click Invite member
- Enter email and select role
- User receives invitation email
- Grant project access as described above
Method 2: Direct User Creation
If email is not configured:
- Navigate to Admin panel (gear icon)
- Go to Staff users
- Click Add user
- Enter:
- Username
- Password (provide securely to user)
- Select Staff status if admin needed
- Click Save
- Add user to organization and projects via Settings
Method 3: SSO/SAML (Enterprise)
If SSO is configured:
- Add user to your identity provider (Okta, Azure AD, etc.)
- Assign PostHog application to user
- User logs in via SSO
- Automatically added to organization
- Grant project access manually (or via SSO attribute mapping)
Granting Access to Multiple Projects
Bulk project access (Cloud only):
- Navigate to Organization → Members
- Find user in list
- Click Edit (three dots menu)
- View Project memberships
- Add to multiple projects at once
- Set role for each project
For self-hosted, repeat project access steps for each project.
Access Scenarios
New Engineer
Organization Role: Member
Projects:
- Development: Admin
- Staging: Member
- Production: Viewer (initially, upgrade later)
Rationale:
- Full control in development for testing
- Can create insights in staging
- Read-only in production until ramped up
Steps:
- Invite to organization as Member
- Add to Development project as Admin
- Add to Staging project as Member
- Add to Production project as Viewer
Product Manager
Organization Role: Member
Projects:
- Production: Member
- Staging: Member
- Development: Viewer
Rationale:
- Create insights and dashboards in production
- Track features in staging
- Visibility into development
Steps:
- Invite to organization as Member
- Add to Production as Member
- Add to Staging as Member
- Add to Development as Viewer
Data Analyst
Organization Role: Member
Projects:
- Production: Member
- All other projects: Viewer
Rationale:
- Full analytics capabilities in production
- Visibility into other environments for context
Steps:
- Invite to organization as Member
- Add to Production as Member
- Add to other projects as Viewer
External Consultant/Contractor
Organization Role: Member
Projects:
- Marketing Analytics: Member (limited duration)
Rationale:
- Scoped access to specific project
- No access to production systems
- Easy to remove when engagement ends
Steps:
- Invite to organization as Member
- Add only to relevant project as Member
- Document expiration date
- Set calendar reminder to remove access
Important for contractors:
- Create a separate project if possible
- Don't grant production access
- Document access scope and duration
- Remove promptly when engagement ends
Executive/Stakeholder
Organization Role: Member
Projects:
- Production: Viewer
Rationale:
- Visibility into key metrics
- Cannot modify insights or settings
- Minimal risk
Steps:
- Invite to organization as Member
- Add to Production as Viewer
- Share key dashboards
- Set up Slack digest if desired
Onboarding Checklist
After granting access, help the new user get started:
Send welcome message:
Hi [Name],
You now have access to PostHog!
Login: https://app.posthog.com
Projects you can access:
- Production (Viewer)
- Staging (Member)
Getting started:
- Review this dashboard: [link]
- Check out our event taxonomy: [link]
- Join #analytics Slack channel
Need help? Ping me or check our docs.
Provide resources:
- Link to internal PostHog documentation
- Event taxonomy/data dictionary
- Key dashboards
- Slack channels for analytics discussions
Set expectations:
- What data is tracked
- How to create insights
- When to use feature flags
- Who to ask for help
Troubleshooting
User didn't receive invitation email:
- Check spam folder
- Verify email address is correct
- Resend invitation
- If self-hosted, verify email configuration
User can't see projects:
- Confirm user accepted organization invitation
- Verify project access was granted
- Check project role (Viewer can't create content)
- Have user refresh browser/clear cache
User has wrong permissions:
- Review organization role
- Check project-level role
- Update role if needed
- User may need to log out and back in
Invitation expired:
- Resend invitation from Organization → Members
- Invitations expire after 3 days
- User can request new invitation
Best Practices
Do:
- Default to Member organization role
- Grant minimum project access needed
- Use Viewer role for stakeholders
- Document why each person has access
- Set review dates for contractors
- Provide onboarding resources
Don't:
- Give everyone Admin access
- Grant production access by default
- Forget to remove users when they leave
- Share API keys instead of proper user accounts
- Grant access without documented approval
Security Considerations
Principle of least privilege:
- Start with minimal access
- Upgrade permissions when needed
- Regular access reviews
Production data protection:
- Limit production access
- Require justification for Admin role
- Monitor for unusual activity
External access:
- Separate projects for contractors
- Time-bound access
- Clear offboarding process
API keys:
- Users should use personal API keys, not shared keys
- Rotate keys if user leaves
- Never commit keys to version control
Documentation Template
Maintain access log:
# PostHog Access Log
## 2024-03-15: Added Jane Doe
- Email: jane@example.com
- Role: Member
- Projects:
- Production: Viewer
- Staging: Member
- Reason: New product manager
- Approved by: John Smith
- Next review: 2024-06-15
Related Resources
- Update Access & Roles - Modify permissions
- Remove User Access - Offboard users
- PostHog User Management Overview - General concepts
Need help? Check PostHog user management docs or contact PostHog support.