Organization settings

The settings area at /dashboard/settings is a horizontal-tab layout with six tabs.

Profile

/dashboard/settings/profile

Edit your organization profile. Fields:

• Name: shown to affiliates on the public application page and in transactional emails.
• Billing email: where Stripe invoices go.
• Timezone: IANA timezone (UTC by default). Affects timestamps shown across the dashboard and email sends.
• Primary brand color: hex like #0E7C7B. Used in transactional email templates and (in future) the public application page accent.
• Logo URL: public URL to your logo image. Used in transactional email templates. You can upload via /dashboard/settings/profile or paste a URL hosted elsewhere.

Save. Changes apply immediately.

Team

/dashboard/settings/team

Invite, manage, and remove team members. Four roles (Owner, Admin, Manager, Viewer). See Team management.

Billing

/dashboard/settings/billing

Shows your current plan, billing period, trial status, and renewal date. The Manage billing button calls POST /api/billing/portal and one-clicks you into the Stripe Customer Portal where you can change plan, update payment method, view invoices, or cancel. Stripe handles proration on its side.

New brands hit /sign-up/plan first (after Clerk auth) to pick a tier and complete Stripe Checkout before they can reach /dashboard. The OnboardingGate redirects any logged-in brand without an active subscription or trial back to /sign-up/plan. See Plans and trials for the full lifecycle.

API keys

/dashboard/settings/api-keys

Create, rotate, and revoke API keys. Each key has:

• Name: human-readable label.
• Prefix: a rk_live_ or rk_test_ prefix shown in the list.
• Plaintext bearer: shown EXACTLY ONCE at creation. Copy it now or you regenerate. Stored as SHA-256 hash on our side.
• Plaintext signing secret: also shown EXACTLY ONCE. Used for S2S tracking signatures. Encrypted at rest.

See Developer authentication for usage.

Webhooks

/dashboard/settings/webhooks

Subscribe to outbound webhook events. Per endpoint:

• URL (HTTPS)
• Event types (*, conversion.created, conversion.approved, payout.created, payout.paid, affiliate.created, affiliate.approved)
• Signing secret (HMAC-SHA256, shown once at creation/rotation)

The WebhookDispatcher background service delivers events to your URL. Failed deliveries retry with exponential backoff up to 5 attempts. Per-endpoint success rate is visible in the list (last 100 deliveries). Click any endpoint to expand its delivery history.

See Developer webhooks for verification code.

Audit log

/dashboard/settings/audit-log

Read-only log of every admin action in your organization. Filter by:

• Action type (program.created, affiliate.approved, payout.run, webhook.created, etc.)
• Entity type (program, affiliate, payout, webhook, organization)
• Date range
• Actor (which team member did it)

Expand any row to see the JSON diff (before / after).

Click "Export CSV" with filters applied to get a CSV. The CSV uses the formula-injection guard from the tax-form export.

Retention is currently indefinite. Per-tier retention windows are on the deferred list.

Migration

/dashboard/settings/migrate

If you are coming from another affiliate platform, this tab is where you bring your existing affiliate roster across. Today the importer reads a Rewardful CSV export and provisions approved affiliates plus their default tracking links in one pass. Optional auto-notify (Growth tier or higher) batch-emails every imported affiliate a brand-customized invite so they can claim their new Rekomi account.

Plan tier requirements:

• Starter or higher to run the importer (trial-eligible)
• Growth or higher with an Active subscription to fan out auto-notify emails (trial users can compose and preview but cannot send)

See the full step-by-step guide on Migrations from other platforms.

Custom affiliate-portal subdomain (Growth)

Every brand gets a free branded affiliate portal at {your-brand}.rekomi.com on every plan, including Starter. Affiliates sign up there: your primary campaign at the root, each campaign at {your-brand}.rekomi.com/{campaign}. On the Growth plan, you can serve those same pages from a domain you control (e.g. affiliates.yourbrand.com) instead. Affiliates see your own domain in the URL bar; Rekomi handles the routing transparently.

Configure the custom domain in Settings → Custom domain (the campaign detail page links there). One domain covers your whole program across every campaign. The flow:

1. Enter the subdomain you want (affiliates.yourbrand.com).
2. Rekomi shows you a CNAME target (cname.vercel-dns.com).
3. Add the CNAME at your DNS provider.
4. Click Verify. Rekomi runs a DNS chain resolution to confirm the CNAME points at the right host. The domain is then auto-attached to our edge so SSL provisions automatically via Let's Encrypt (typically 1-5 minutes). Verification typically completes in 15-60 minutes depending on DNS propagation.

Once verified, your primary campaign's public application URL is https://{your-domain}/ and each campaign lives at https://{your-domain}/{campaign}. These are clean paths, one per campaign, serving the same landing page renderer that powers your free {your-brand}.rekomi.com portal.

Plan gate: Growth tier required (unified with the tracking custom domain, one "Custom domain" feature at Growth). The free {your-brand}.rekomi.com portal stays available on every tier; Growth only adds the option to put it on your own domain. Lower tiers see an upgrade prompt.