Access & secrets

Performance data follows your workspace membership:

Who can do what

Need Typical role
View runs and scenarios Viewer or higher
Create/edit scenarios and collections; start collection-run plans Member or higher
Delete scenarios, manage collection webhooks Admin or owner

API tokens used by the CLI should only include the scopes your automation needs. Prefer short-lived tokens in CI, and never paste tokens into guides, tickets, or screenshots.

Platform system_admin operators may read broadly for support; they do not replace org owner / admin for organization settings writes.

Environment secrets

Variables marked secret are hidden in the UI by default (Workspace → Environments). Reveal only when you need to verify a value.

When capturing screenshots for support or docs: blur or omit secret columns; prefer staging environments.

Sealed secrets

Organizations can enable sealed secrets so sensitive connection tokens and environment values are encrypted before they are stored. In the app you paste the secret once; Spanline keeps a sealed form. Runners that need the value use your organization’s private key configuration — contributors normally do not handle crypto details day to day.

If a run fails after a key rotation, ask an org admin to confirm CI still has the current private key (SPANLINE_ORG_RSA_PRIVATE_KEY / file env). See also Run tests.

Collection webhooks

Collection webhooks let an external system create a collection-run plan. Configure them in the collection editor (Webhooks), not a separate admin console.

Saved Performance snapshots can be shared outside the workspace via Embed & share → Public link on the full-page snapshot viewer (/performance/reports/view/{id}).

Piece Behavior
View URL https://app.spanline.dev/p/r/view/{gateToken} — password gate only; no embed secret in the URL
Password Six characters, generated on create/rotate — workspace members can reopen credentials on an active share
Unlock Recipient enters password on the branded unlock screen (desktop split / mobile stacked)
Embed URL Issued after successful unlock — https://app.spanline.dev/p/r/embed/{embedToken} — valid 24 hours
Revoke / rotate Workspace member from the same toolbar — revoking clears active embed tokens

Treat embed URLs like short-lived credentials. Do not paste them into long-lived docs, chat, or screenshots for external audiences.

Workspace embed (/performance/reports/embed/{reportId}) still requires a normal Spanline sign-in and workspace membership.

Full walkthrough: Reports & sharing.

Artifacts

Uploaded artifacts can contain logs or dumps. Download links require sign-in; still avoid uploading files that contain unnecessary production secrets. Header Download on run detail is the summary JSON; individual files live under the Artifacts tab.