PostHog

Tidal Control's PostHog integration reads the configuration of your PostHog organisation for compliance purposes. It authenticates with a personal API key against the PostHog REST API. Because PostHog ingests behavioural event data, often including IP addresses and full session recordings of real users, its configuration matters for both privacy and access-control audits.

What this integration monitors

Organisation policy: Two-factor enforcement, verified-domain SSO, who may invite members or create projects, public sharing and AI data-processing settings
Members and invitations: Per-user MFA, membership level, dormant accounts, unverified email and stale pending invites
Domains: SSO enforcement per domain, JIT provisioning and SCIM presence
Project privacy: IP anonymisation, session replay opt-in and sample rate, input masking, console log capture, recording domain allowlists and event retention
Project secret API keys: Rotation, last use and scope breadth
Feature flags: Flags left active after a rollout, ownership and unencrypted remote-config payloads
Dashboards: Public sharing links that expose analytics to anyone with the URL

Requirements

Super User role in Tidal Control
A PostHog account with organisation-level access
Your PostHog regional API URL

Configuration step-by-step plan

We'll find your regional API URL, create a personal API key, then add the connection in Tidal Control.

Configuration steps:

Find your API URL
Create a personal API key
Configure the integration in Tidal Control

Step 1: Find your API URL

PostHog's management API lives on your regional host.

Region	API URL
US Cloud	`https://us.posthog.com`
EU Cloud	`https://eu.posthog.com`
Self-hosted	Your own base URL

Warning

This is not the ingestion host. Event capture uses *.i.posthog.com, which does not serve the management API this integration reads. Use us.posthog.com or eu.posthog.com, matching the region your PostHog account lives in.

Step 2: Create a personal API key

In PostHog, open your account menu and go to Personal API keys
Click Create personal API key and give it a name, for example Tidal Control
Grant these read-only scopes:

Scope	Covers
`organization:read`	Organisation settings, domains and roles
`organization_member:read`	Members and pending invitations
`project:read`	Projects and project secret API keys
`feature_flag:read`	Feature flags
`dashboard:read`	Dashboards

Copy the key (phx_...) immediately: it is shown only once

Warning

A project secret API key cannot be used. A phs_ project key is scoped to a single project, so every organisation endpoint refuses it, and that covers five of the nine things this integration reads. Use a personal API key (phx_...).

Step 3: Configure the integration in Tidal Control

Go to Settings → Integrations in Tidal Control
Click the plus icon next to PostHog
Fill in the configuration:
- Name: A descriptive name, for example PostHog
- API URL: The regional host from step 1
- Personal API key: The phx_... key from step 2
Click "Create" to save the integration

Configuration fields explained

The integration dialog asks for the following values:

Name:

A descriptive name for this connection
For example: PostHog, PostHog EU

API URL:

Your regional PostHog host, including the https:// scheme
Required. There is no working default, so an empty value is rejected

Personal API key:

The phx_... key from step 2
Required, stored as a secret, and must not contain spaces

Verification

The integration is working when all of the following are true:

Settings → Integrations shows PostHog under Configured Integrations
PostHog tests are available in the Tests section
Test refresh delivers results without authentication errors

Frequently asked questions

Why a personal API key and not OAuth? PostHog supports OAuth, but Tidal Control does not yet implement an authorisation-code flow for integrations. A personal API key is the credential that works today.

The key is tied to a person. What happens when they leave? The key stops working when that account is removed, and the integration then fails to authenticate. Create the key on an account that outlives individual staff changes, and treat it as shared infrastructure.

Does Tidal Control read our analytics events? No. It reads configuration only: organisation and project settings, members, keys, flags and dashboard sharing state. Event data and session recordings are never fetched.

Common problems

"API URL is required"

The field is empty. Enter https://us.posthog.com or https://eu.posthog.com

"API URL must start with http"

Include the scheme, for example https://us.posthog.com rather than us.posthog.com

"API Key must not contain whitespace"

The pasted value picked up a space or line break. Paste it again

Organisation tests error while project tests work

The key is a project secret key (phs_...), or is missing organization:read. Use a personal key with all five scopes

Still can't figure it out?

Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible.

Info

Gather support info: Note which browser you're using, exact error messages, and which steps you've already tried. This speeds up the solution considerably.