Providers / PostHog

Analytics

PostHog API keys and credentials

What every PostHog credential a founder holds does, whether it expires, and what tends to break. Each fact links to PostHog's own docs.

Last checked 2026-11-06 · posthog.com

At a glance

Each credential

PostHog dashboard login

• Not documented

Dashboard login. Session and 2FA policy not documented on the pages reviewed. Access to projects is controlled through organization membership.

PostHog docs

Personal API key (phx_)

• Not documented
• Can be scoped

Created under account settings > Personal API keys; the value is shown only once. Scopes are chosen at creation (examples such as insight:read or * for full access) and can be changed later. Access can be organization-wide, specific projects, or all projects. Up to 10 keys per account. No expiry setting is documented on the pages reviewed. Keys can be rolled (new value, old value invalidated) or revoked individually. Keys are deleted when their user is removed. A key leaked to public GitHub is automatically rolled and the user is emailed.

PostHog docs

Project token (phc_, used in frontend snippet)

• Not documented
• Full access only

Found on the Project page. The same token is embedded in the frontend snippet posthog.init(...) and used for public endpoints (event capture, flag evaluation). The docs do not say whether it can be rotated or expires; the phc_ prefix was not confirmed on the page reviewed.

PostHog docs

Project secret API key (beta, server-to-server)

• Not documented
• Can be scoped

Intended for server-to-server access not tied to a user. Scoped to a single project with only the scopes granted. Rolling out gradually; may not be available in every organization. Expiry and rotation details not documented on the pages reviewed.

PostHog docs

What usually goes wrong

• Personal API key pasted into frontend code or a public repository; GitHub scanning may roll it, which breaks any other place it was used
• Rolling a personal key invalidates the old value, so every CI job or script still holding it fails at once
• Personal key created with broad scope (all projects or *) when only one project's data is needed
• Project token (phc_) assumed to be secret and rotated, which is not how it works; it is designed to be public
• Personal API key lost because the value is shown only once; a new key must be created and rolled into every consumer
• Key stops working after the owning user is removed from the organization, since personal keys are deleted with the user

Renewals and billing

Usage-based product analytics with a free tier per the pricing page headline. Billing cadence, invoice access and billing API were not confirmed on the pricing page reviewed (content truncated).

What PostHog's docs don't say

We couldn't confirm these from official docs, so don't rely on them either way:

• Whether personal API keys have any expiry option (none documented on the pages reviewed)
• Whether expiry or last-used data is visible via API
• Exact prefix of the project token (phc_ assumed from common usage; not confirmed on the pages reviewed)
• Rotation and expiry behavior of the project secret API key (beta)
• Billing cadence, invoice access, and whether a billing or usage API exists
• Dashboard login session lifetime and 2FA policy
• Whether a paid plan renewal applies to a typical founder account
• Public steps to cancel or downgrade a self-serve plan (no customer doc found 2026-11-07; the pricing page only covers billing limits)

Rotating or replacing a PostHog key

The steps are the same for most providers: make the new key, deploy it everywhere the old one is used, check it works, then revoke the old one. Our guides walk through it:

Sources

• posthog.com/docs/api/personal-api-keys
• posthog.com/docs/api/overview
• posthog.com/docs/getting-started/install
• posthog.com/pricing

Keep track of every PostHog key

StackHangar stores your PostHog keys in an encrypted vault, grouped by the product they belong to, warns you before they expire, and walks you through rotating them. We can't read your secrets.