The console and Settings
The web console is served by the engine on CONSOLE_HOST. It is plain HTML, CSS and JavaScript with no framework, and installs as an app: Add to Home Screen on an iPhone, Add to Dock on a Mac.
Signing in
The first time, sign in with any username, such as admin, and the server's ADMIN_PASSWORD. With two-factor sign-in on, the console then asks for the code from your authenticator app, or a recovery code. A passkey signs in without either. The server answers with an HttpOnly session cookie, for 12 hours or, with "Keep me signed in", 30 days. No script can read it, and the console keeps nothing about the session in JavaScript or in storage.
Overview
Every app's visitors and pageviews with their change against the previous period and a trend, who is here now, open requests and the waitlist, as cards or a sortable table, and the latest requests.
Dashboard

- Totals: visitors, visits, pageviews, views per visit, bounce rate and visit duration, each with its change.
- The chart: visitors and pageviews, the previous period dashed, and up to three custom events. Drag across it to zoom into that time.
- Breakdowns: pages (top, entry and exit), sources (with UTM source, medium and campaign), a map and countries, devices, browsers and operating systems, languages, goals and feedback ratings.
- Filters: click a row to filter everything by it; the chips at the top remove filters. Saved segments (Settings › Apps) apply a set of filters in one click.
- Time windows: 30 minutes, 24 hours, a month, everything, or any range in the picker, to the minute.
- Your own layout: Customize arranges the panels, and you can keep several dashboards per app. See Dashboards and funnels.
Each app
Under each app in the sidebar: its Dashboard, Events, Funnels, Errors (Tracking errors) and Tracing with its traces, logs and services (Tracing). The Lab lists every app's experiments and feature flags (A/B tests and feature flags). A feature switched off for an app leaves its menu.
Inbox
Requests from every app by status (open, in progress, resolved, spam, archived), with filters by kind and app, search and CSV export. One request shows what was sent with its context (page, version, browser, device, country, your own fields), its attachments, its notes and its history. Reply opens an email to the sender; resolved requests can be archived in one go.
Waitlist

Every app's lists and their counts, signups per day, and the signups with their status (waiting, invited, joined). Change a status, remove a signup, or export the list as CSV. Changing a status sends no email; inviting people is up to you.
Privacy and notifications
Privacy finds everything stored for one email address across every app, downloads it, or erases it, for access and deletion requests. The bell shows what arrived since you last looked.
Settings
| Page | What it holds |
|---|---|
| Apps | Every app's settings, in sections with a search field: General (domains, icon, the server key, the setup snippets), Collection, Features, Forms and inbox, Waitlist, Errors (capture switches and ignored messages), Tracing (sample rate, denied attributes and the exporter settings), Privacy and retention, Import from Google Analytics, Integrations (a webhook and a Turnstile secret) and the danger zone. Each section shows its settings first, with Edit to change them. |
| Team | Users, roles and per-app access, invites, the two-factor rule and the audit log. See Teams and sign-in. |
| Features | The server's feature switches, and what each app has on. See Feature switches. |
| Security | Two-factor sign-in with an authenticator app, recovery codes, passkeys, and your own username and password, which replace ADMIN_PASSWORD for signing in. |
| Profile | Your name and photo. |
| Devices | Pairing codes for the iPhone, Mac and terminal apps, and the devices connected; rename or remove one, and it is signed out at once. |
| AI access | The MCP server's switch and address, the AI clients and API keys connected, and new API keys. See MCP and API keys. |