Skip to main content
Organizations represent your team or business in Braintrust. Each organization contains projects, users, and organization-wide settings. You can create multiple organizations to organize projects differently, and users can be members of multiple organizations. Configure your organization by going to Settings. Its sidebar lists organization, project, and personal settings together under headings such as Team, Automations, and Data, and project settings apply to the project you’re working in. To find a setting, type its name in Search settings at the top of the sidebar, or search for it in the command bar. You can also customize organization settings using the API.

​
Create an organization

To create a new organization:
  1. Click your organization name in the breadcrumbs at the top of the page and select + Create organization.
  2. Enter a name for your organization.
  3. Select a data plane region (US or EU) from the dropdown. The region is pre-selected based on your location, but you can change it before continuing.
    After creating an organization, you cannot change its data plane region.
  4. Click Continue.
After creating an organization, you’ll see onboarding information you can follow to instrument your code and start logging traces to Braintrust.

​
Data plane region

Braintrust’s architecture has two main components:
  • The data plane stores all sensitive data, including experiment records, logs, traces, spans, datasets, and prompt completions. It consists of the Braintrust API, a PostgreSQL database, Redis cache, object storage, and Brainstore (a high-performance query engine for real-time trace ingestion).
  • The control plane provides the web UI, authentication, user management, and metadata storage (project names, experiment names, organization settings). The control plane does not store or process your sensitive data.
Each data plane region has its own endpoint: The web app is at https://www.braintrust.dev for every organization, including EU and BYOC organizations. Your data plane region determines only the API URL.
https://gateway.braintrust.dev is the global hosted Gateway endpoint. It uses DNS latency routing and health checks across Braintrust-hosted Gateway regions. Gateway routing is separate from your organization’s data plane region. When logging is enabled, Gateway logs are written to your organization’s configured data plane.
After creating an organization, you can view its data plane region and API URL at Settings > Data plane.
If your organization requires storing data in your own cloud, see Deployment options to compare SaaS and BYOC.

​
Configure BYOC endpoints

After Braintrust provisions your BYOC deployment, configure your organization with the endpoint URLs your account team provides. Configuring data plane URLs requires an Enterprise plan. If your organization leaves the Enterprise plan, existing URLs remain in effect, but you can no longer change them.
  1. Go to Settings > Data plane.
  2. Enter the API URL, Gateway URL, and Realtime URL provided by Braintrust.
  3. If the data plane is behind a VPN or on a private network, enable Data plane is on a private network. This lets Braintrust detect blocked browser local-network permissions and show instructions for granting access.
  4. Click Save and run the provided connectivity tests.
Saving these URLs automatically provisions a service token that enables features such as data retention. You can view and refresh it in Service tokens.

​
Find your organization ID

Your organization ID is a UUID used in API calls and audit log queries. To copy your organization ID or name to the clipboard:
  1. Click your organization name in the breadcrumbs at the top of the page.
  2. Hover over the current organization (marked with a checkmark) to open its submenu.
  3. Select Copy organization ID or Copy organization name.

​
Manage members

​
Invite members

To add members to your organization:
  1. Go to Settings > Members.
  2. Click Invite.
  3. Enter email addresses (one per line for multiple invites).
  4. Select one or more permission groups.
  5. Click Send invites.
You can also invite members directly from the projects page by selecting the Members > Invite members. Invited members receive an email with a link to join your organization. They must be assigned to at least one permission group.
When SCIM provisioning manages your organization’s membership, Invite is disabled and the API rejects membership changes. Add the user to your identity provider’s mapped group instead. Service accounts are exempt and can still be added by hand.

​
View member 2FA status

Only organization owners can check whether members have turned on two-factor authentication (2FA) for their Braintrust account. Go to Settings > Members and check the 2FA column. Braintrust shows a status only for members whose email address uses the same domain as yours. A member’s 2FA setting covers their whole Braintrust account, not only your organization, so owners outside their domain can’t see it. Members on other domains show Unknown. If your email address uses a personal email provider, such as Gmail, every member shows Unknown.

​
Remove members

To remove members from your organization:
  1. Go to Settings > Members.
  2. Hover over the member’s row, then click Remove member at the end of the row.
  3. Click Remove to confirm.
Organizations must have at least one member. You cannot remove yourself from an organization. To transfer ownership or leave an organization, ensure another member is present and can manage the organization after you leave.
When SCIM provisioning manages your organization’s membership, the remove control is disabled and the API rejects membership changes. Remove the user from your identity provider’s mapped group instead. Service accounts are exempt and can still be removed by hand.

​
Configure permission groups

Permission groups are the core of Braintrust’s access control system. They are collections of users that can be granted specific permissions to projects, experiments, and datasets.
  1. Go to Settings > Permissions.
  2. View existing groups or create new ones.
  3. Assign users to groups when inviting members.
For detailed information about creating and managing permission groups, see Control access.

​
Manage API keys

Create API keys for authentication:
  1. Go to Settings > API keys.
  2. Click + API key.
  3. Enter a name to identify the key.
  4. Choose an expiration. It defaults to one year and cannot be changed after creation.
  5. Click Create.
  6. Copy the key immediately (it won’t be shown again).
API keys inherit permissions from the user who created them. Organization owners can view and manage all API keys in the organization. To list every member’s API keys programmatically, call GET /v1/organization/api_keys as an organization owner:
curl
The response contains key metadata only, never the key secret. Service tokens aren’t included. To list them, call GET /v1/service_token. GET /v1/api_key returns only your own keys, even for organization owners.
  • The endpoint lists keys in the organization your API key is scoped to. If your key isn’t scoped to an organization, pass the org_id query parameter.
  • Callers who aren’t owners of the organization get an empty list, not an error. A request whose org_id doesn’t match the organization your API key is scoped to also gets an empty list.
  • Each request returns up to 1,000 keys. To list more, pass the last key’s id as the starting_after query parameter and repeat until a request returns no keys.
API keys can be created only in the Braintrust UI, not through the API.
Store API keys securely. Anyone with an API key can access Braintrust with the permissions of the key’s creator.

​
Disable API key creation

To prevent members from creating new API keys:
  1. Go to Settings > API keys.
  2. Toggle Disable API key creation on.
When API key creation is disabled, members cannot create new keys. Existing keys continue to work. The setting applies only to personal API keys and doesn’t block service token creation. Only organization owners can change this setting.

​
Create service tokens

Service tokens enable system integrations without tying credentials to individual users:
  1. Go to Settings > Service tokens.
  2. Click + Service token.
  3. Enter a name for the service account.
  4. Assign permission groups or grant specific permissions.
  5. Enter a name for the service token.
  6. Choose an expiration. It defaults to one year and cannot be changed after creation.
  7. Click Create.
  8. Copy the token immediately (it won’t be shown again).
Project-group Owners select a project group when creating the account. The account receives read access to that group. Only organization owners can assign permission groups during creation. Service tokens use the bt-st- prefix. Pass a service token as the bearer token in API requests or as the API key in SDK calls. Requests use the service account’s permissions. Service tokens also support user impersonation when the service account has the Owner role in every organization the target user belongs to. The target user must belong to at least one organization. These requirements apply to the service account, not the person who created the token.
Organization owners and Owners of an active project group in the organization can create service tokens, either at Settings > Service tokens in the Braintrust UI or by calling POST /v1/service_token and authenticating with a service token whose account has organization-owner permissions or owns an active project group in the organization. Project-group Owners can list or revoke tokens for an account with a permission grant on a project group they own. Creating a token requires all of the account’s permissions in the organization. If you are missing any permissions, the request returns a 403 error. Existing tokens continue to use the account’s permissions after permission changes. User API keys cannot be used to create service tokens. If the calling service token has an expiration, the new token’s expires_in_seconds must be set and can’t exceed the caller’s remaining lifetime. Otherwise, the request returns a 403 error that states the maximum allowed value.

​
Configure AI providers

Configure organization-wide AI provider credentials so playgrounds, experiments, and the gateway can call models without users needing individual API keys. See Configure AI providers.

​
Configure Loop

​
Choose models for Loop

Loop runs on Braintrust’s built-in models or on your organization’s own OpenAI-compatible AI providers.

​
Set a default provider for Loop

Choose the provider that new Loop threads and automations use across your organization. Loop selects that provider’s recommended model. Automations with Auto on follow this setting on every run, so changing it affects their future runs. Members can choose a different provider or model for individual threads and automations. Only members of the Owners permission group, or a custom permission group with the Manage settings organization permission, can change the default provider.
  1. Go to Settings > Models.
  2. Under Loop default provider, select Braintrust, if built-in models are available, or an organization provider that serves a supported Loop model. Only organization providers can be the default. To add a provider, select Add provider.
After you set the default:
  • Unavailable default: If Loop default provider shows Provider unavailable, choose another provider or resolve the issue shown, such as missing access or no supported Loop models. See Models and providers for how new threads choose a provider in this case.
  • Project overrides: Inside a project, a project provider with the same name as the default overrides it. If that provider serves no supported Loop model, the default is unavailable in the project, and Loop doesn’t fall back to the organization provider.

​
Control Loop logging

By default, Braintrust logs frontend Loop interactions for product improvement and support. To opt out:
  1. Go to Settings > Models.
  2. Turn off Enable logging for Loop.
When Loop logging is off, Loop continues to work normally, but Braintrust does not log frontend interactions. BYOC organizations have Loop logging off, and the setting doesn’t appear.

​
Enable Slack integration

Connect Slack to send alerts and notifications to your channels. Only members of the Owners permission group, or a custom permission group with the Manage settings organization permission, can manage the Slack workspace connection.
  1. Go to Settings > Integrations.
  2. Click Enable Slack.
  3. Authorize Braintrust to access your Slack workspace.
  4. Select which channels Braintrust can access.
Once enabled, you can configure alerts to send notifications to specific Slack channels. Braintrust also sends Slack direct messages to assignees when spans or dataset rows are assigned to them for review, if they have linked their Slack accounts. See Set up alerts, Set up spend alerts, and Assign rows for review for details. If the Braintrust Slack app is updated with new permissions, a warning banner and Refresh permissions button will appear next to your connected workspace. Click Refresh permissions to re-authorize through the OAuth flow and enable the latest features. When the Slack integration is enabled, Braintrust automatically expands links to logs, traces, and experiments that you paste into Slack. What each preview shows depends on whether you have linked your Slack account. Supported link types:
  • Log URLs.
  • Trace URLs.
  • Experiment URLs.
Braintrust shows a public preview with the resource title and description for all Slack users, including those who have not linked their account. Private resource details are only shown to Slack users who have linked their Slack account to a Braintrust account with access to the resource. To link your accounts, run /braintrust link in any Slack channel, or click Link Braintrust account in the prompt Braintrust sends when you open the Slack App Home or first interact with a link preview. When you link from the App Home prompt and the Braintrust account you are signed in to uses a different email address than your Slack account, the authorization page displays a warning with a Switch account option. To unlink later, run /braintrust unlink in Slack.

​
Set environment variables

Define secrets available to all functions in your organization:
  1. Go to Settings > Runtime.
  2. Under Environment variables, enter a name and value in the Add a variable form.
  3. Click Save.
Environment variables are accessible from prompts, scorers, and tools. Use them for API keys, database credentials, or configuration values. Each variable lists a redacted preview of its value and a Last updated timestamp that tracks when the value itself was last changed, along with the user who made the change. Renaming a variable or editing other metadata does not bump this timestamp.

​
View data plane URLs

To see your organization’s region and API URL, go to Settings > Data plane. For a BYOC deployment, Braintrust sets these URLs when it connects your organization to the data plane.

​
Set git metadata logging

Control which git metadata fields are logged:
  1. Go to Settings > Ingestion.
  2. Under Git metadata, enable Collect git metadata.
  3. Select the fields to log. Your changes save automatically.
Git metadata helps track which code version generated specific logs or experiment results.
Diff content is opt-in. By default, Braintrust collects standard git metadata but not the Diff field. To capture diffs, enable Diff here. The server strips git_diff from logged repo info unless your org has enabled it, regardless of what the SDK sends.Until you save a policy here, the Python SDK (v0.23.0+) collects no git metadata by default. Pass git_metadata_settings in code to override.

​
Redact sensitive log data

Ingestion redaction detects and replaces sensitive text in incoming project logs. Create protected fields for one project or all projects in your organization. See Create protected fields for setup and permissions. To hide fields from selected members when they read logs or datasets, without changing stored data, use read rules.

​
Control image rendering

External images in logs can send sensitive data to untrusted servers when your browser loads them. Configure image rendering to control this risk:
  1. Go to Settings > Runtime.
  2. Under Image rendering, select a mode:
    • Auto-load images: Images are loaded automatically (default).
    • Click to load: Show placeholder, click to load each image.
    • Block all images: Never load external images.
Some image URLs are never loaded automatically, whichever mode you select. This covers URLs that name a host on your local or private network, such as localhost, a .local name, or a private or link-local IP address, and URLs using a scheme that a browser should never load an image from, such as javascript: or file:.In Auto-load images and Click to load, these images show a Load image button, so loading one is always a deliberate choice. In Block all images, they are blocked along with every other external image. Inline data: and blob: images are unaffected, because they never leave the browser.

​
Configure environments

Create environments to version prompts and functions:
  1. Go to Settings > Environments.
  2. Click + Environment.
  3. Enter environment name (e.g., “production”, “staging”, “dev”).
  4. Click Create environment.
Assign prompt and function versions to environments to separate development from production. See Manage environments for details.

​
Delete an organization

To delete an organization, contact Braintrust.

​
Next steps