# Settings and access

> Reference · https://spoletta.com/docs/admin

Settings cover what an instance shares: the MCP servers agents may use, the keys their models need, and the people and teams who use it. Ownership decides who sees and changes each flow.

## The settings tabs

Open **Settings** from the flow list. Which tabs you see depends on who you are:

| Tab | Who sees it | What it holds |
| --- | --- | --- |
| Account | Anyone signed in | Your email, what you can do, your teams and your roles |
| Model keys | Admins | The model providers' API keys |
| MCP servers | Everyone | The servers agents may use, and your own connections to them |
| Teams | Anyone signed in | Teams and their members |
| People | Admins | Who uses the instance, and what they may do |

> **Note:** Sign-in is optional for an instance. Without it, everyone sees every tab an admin would, and everything is everyone's. See [Sign-in and secrets](https://spoletta.com/docs/sign-in.md).

## MCP servers

MCP servers give agents tools: Slack, Sentry, Jira, your own. An admin adds a server by its URL (the name is filled in from it) with an optional description. Each person then connects to it for themselves with **Connect**, signing in in a browser window, and can **Disconnect** or **Sign in again** later.

An agent step uses the connections of whoever its run is for, so an agent acts as that person. In an agent's settings, a server you haven't connected shows *Not connected* with a **Connect** button. See [Scripts, Sentry and tools](https://spoletta.com/docs/tools.md).

## Model keys

Agents' models need their providers' API keys. The tab lists one row per key, with the providers that read it, and says whether it is *Saved here*, taken *From the worker's environment*, or *Not set: models of these providers fail*. Paste a key and press **Save**; it is never shown again. **Remove** deletes it.

Saved keys, and the tokens of people's MCP connections, are kept sealed in the database when the instance has a secret key. See [Sealing secrets](https://spoletta.com/docs/sign-in.md#secrets).

## People and roles

Admins add people by email. For each person they can set:

-   **Admin**: configures the instance and can decide any review. You can't change your own.
-   **Team manager**: makes and manages teams.
-   **Roles**: added with “Add a role”, removed with ×.

A role matches [person objects](https://spoletta.com/docs/objects.md) of the same name on any board. Give someone the role *Finance*, and they decide the reviews of every human process *Finance* handles. A review no person object handles is anyone's to decide. Someone without the role sees *Only Finance decides this*. Removing a person hands their flows to you.

## Teams

Everyone can see the teams and their members. Admins and team managers create teams (**New team**), rename them, add members (“Add someone…”), remove them with ×, and delete teams.

## Who sees a flow

Every flow, procedure and struct belongs to someone: **Only me** (its maker, by default), a **team**, or **Everyone**. Change it with the owner picker on its card in the flow list, or under **Who sees it** in its settings.

-   Its owner, members of its owning team, or an admin can give it to someone else.
-   Only an admin can take back a flow given to everyone.
-   People who hold a role a flow's reviews need see that flow read-only, so they can follow the work they decide. Their card reads *Reviewing*.

On the flow list, two pickers help:

-   **Show** filters the list: *Every flow I see*, *Mine*, *Those I review*, *Everyone's*, or a team's.
-   **New ones belong to** sets who owns what you create next: one of your teams, *Only me* or *Everyone*. It is remembered in your browser.