Settings, access, and integrations
Find project administration without navigating a long Admin sidebar.
Where settings live
Open Settings for workspace configuration: General, Team & Access, Integrations, MCP, API Keys, Virgil, and Billing & Usage. General contains workspace name, primary username, timezone, and language. Team & Access keeps member search, role filters, invitations, and a secondary roles & permissions dialog. Billing shows your current plan and recorded hub-member usage before available plans.
Public domain, favicon, and SEO/social-sharing fields live in Webhub → Settings, not workspace General. Dashboard hostname is not customer-editable here. Settings search also finds feature configuration destinations. Reports live in Insights and Community Support in Gamification.
Connect a platform
Open Integrations, choose the intended platform, and finish its configuration or authorization flow. Use the same project throughout. A disconnected platform or one without collected data will not automatically produce an Insights report. Do not share OAuth secrets, bot tokens, or MCP keys in documentation.
Check the workspace and permissions
Before editing team access or billing, confirm the workspace name in the switcher. Switching projects changes the context of your actions. If a control is unavailable, ask a project administrator to check your access or enabled capabilities rather than attempting to use another project’s credentials.
Generate and manage API keys
Open Settings → API Keys as a project administrator. Give each integration a descriptive name and select Generate API key. Copy the key immediately; the dashboard only shows the full key on creation. Existing keys are listed by name, masked suffix, and creation date.
Use Authorization: Bearer YOUR_API_KEY with Harbor’s external API routes. New hubs have all external API routes enabled at a default limit of 60 requests per minute per route and key. These keys allow reads and writes through your enabled project API routes; they do not offer per-key read-only scopes. Store them on your server, never in public browser code or repositories. API access and usage remain subject to your current plan.
To rotate a key, create a replacement, update your integration, and then revoke the old key. Revocation can take up to 30 seconds to clear authenticated request caches. Revoked keys cannot be restored. MCP keys are separate and remain under Settings → MCP.