Your account

#People

Four roles. Everyone sees the same campaigns, offers, landing pages and reports; what differs is what they can change:

Everyone can change their own profile, password and sessions, export reports, and ask for help.

A contributor's campaigns, offers and landing pages are the ones they made from the day the role existed. Anything made earlier has no recorded creator, so a contributor cannot change it — an admin or member still can. The Campaigns list has a Created by column, off by default, that shows whose each one is.

The rules are enforced by the API, not only by the screen: a viewer's script using someone's session gets the same refusal as the page would. An API key acts as a member, or as a viewer when it is read-only, and only an admin can make one.

A member sees the people list. Only an admin sees pending invitations, because an admin is the only one who can act on them — showing a list to someone who cannot do anything with it is a screen that only raises questions.

Everything in the product has been scoped by organisation from the start, so adding a person changes who can reach the data rather than creating a second copy of anything.

#Settings

Eight tabs:

Security is worth opening once even if nothing is wrong. The signed-in devices list is the only place a session you do not recognise becomes visible, and ending one there is immediate.

#Language

General → Language switches the app between English, Russian, Spanish, Portuguese (Brazil) and Hindi. It is an account setting, like the currency and time zone beside it, and the web address stays the same in every language.

The translation is being done screen by screen: the menu down the left is translated today, and the rest of the app follows. The admin screens stay in English.

#Two-factor sign-in

With two-factor on, signing in asks for a six-digit code after your password, from an authenticator app on your phone — Google Authenticator, Microsoft Authenticator, 1Password, Authy or any other. Somebody who has your password still cannot get in without your phone.

1. Open Settings → Security, switch Two-factor sign-in on and enter your password.
2. Scan the QR code with the app, or type in the key shown under it.
3. Enter the code the app shows, then save the ten recovery codes.

Each recovery code signs you in once without your phone, for when it is lost or broken. Keep them somewhere other than the phone. New recovery codes makes a fresh set, and the old set stops working. Turning two-factor on signs out your other devices.

It is each person's own: everyone on a team turns it on for themselves, and a team admin cannot turn it on or off for somebody else. Turning it off needs your password and a code.

After five wrong codes, signing in waits fifteen minutes.

Lost your phone and your recovery codes? Contact support. Once we have checked it is you, we turn two-factor off, and you can turn it on again with the new phone.

#The API key

Under Settings → API. It is the credential for reading your own data programmatically. When you create one, choose its access:

• Read & write can read everything and make changes, as a member can.
• Read only can read everything and is answered 403 read_only_key ("This API key is read-only") when it tries to create, change or delete. Give this one to reporting tools, spreadsheets and other people's scripts.

The choice is fixed once the key exists; for different access, create a new key and revoke the old one. Keys made before the choice existed are read & write.

A key can also expire — after 30 days, 90 days or a year, or never. Past that date it is refused like a revoked key. Everyone on the account who gets Security notifications is warned in the bell and by email a week before.

Rotate gives a new key with the same name and access, and keeps the old one working for 24 hours, so a script can be moved to the new key without a gap. A key that expires gets its full lifetime again from the day it is rotated.

Each key shows when it was last used, how many calls it made in the last 7 days, and who created it — and, once revoked, who revoked it and when. A key with no calls for a week is usually safe to revoke.

The API is on the Growth, Pro and Scale plans. On a plan without it, no key can be made, and a key made earlier gets a 402 plan_limit answer until the plan includes the API again. Nothing is deleted.

Calls are limited per minute for the whole account, all keys together: 300 on Growth, 600 on Pro and 1,200 on Scale. Every answer to a key carries RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset (seconds until the minute starts again). Past the limit the answer is 429 rate_limited with a Retry-After header; wait that many seconds and send the call again. The dashboard itself is never limited.

Lists — campaigns, offers, landing pages, traffic sources, networks, domains, flows, saved rules, bot lists, short links and report exports — come back 500 rows at a time. Ask for fewer with ?limit= (1 to 500). While more remain, the answer has a next_cursor: send it back as ?cursor= for the next page, and stop when it is null. A cursor that was not given out is refused with 400 bad_cursor. A row created or deleted while you are between pages can move the rest by one, so read a list in one go rather than across hours.

Treat it as a password: it belongs in a secrets store, not in a spreadsheet, a shared document, or a repository. If one has been somewhere it should not, replace it rather than hoping.

It is not the tracking tag's site key, which is a public value that appears in the source of every page carrying the tag and is meant to.

#Billing

Plan and invoices are under Settings → Billing.

Plan limits are enforced on the click path, and the counter reconciles rather than being exact to the click — so a figure that lags slightly behind a report is not a bug.

What each plan allows is checked when you add something, not afterwards:

Limit	What counts
Tracking domains, campaigns, offers, landing pages	Each one you have. A copied campaign counts too
Team members	People on the team and invitations still open
Integrations	Live traffic sources with their tokens filled in, and live affiliate networks with a postback mapped. A paused one does not count
Conversion goals	Paid plans. Goals made earlier keep working; postback conversions work on every plan
REST API	Growth, Pro and Scale
API calls a minute	Every call made with a key, all keys together
Click history	How far back the click log, a click's details and IP activity reach. Reports keep every date

Moving to a smaller plan keeps everything you have; it only stops adding more past the new limit.

Invoices are issued automatically on renewal and emailed as PDFs, on paid plans and free ones alike.

Refunds are within 14 days, and crypto payments are not refundable — stated here because it is the kind of thing worth knowing before paying rather than after.

#Getting help

The ? at the top of every screen has three ways in:

• Documentation — these pages.
• Live chat — a person answers. Your name and email come with you, since you are already signed in, so you do not have to type them.
• Support — everything worth sending with a question, ready to copy.

The Ask button at the bottom right answers from this documentation first, and says so when it has not found anything rather than guessing. Talk to a human opens the live chat and copies the conversation so far, so you can paste it in instead of typing it again.

The Support screen gathers what a first message needs: which install, which domain, what time, what was on screen — in a block you can copy.

Most of the delay in getting help is the round trip spent asking those, and half of it is knowable from that page. Send it with the campaign alias, and if it is a landing page problem, the exact address a visitor reaches.