Multi-user setup

What's shared vs per-user

Sprintra's data model is simple: project state is shared, identity is per-user.

Cloning a Sprintra-enabled repo

The team lead binds the repo to a Sprintra project once (creates .sprintra/project.json) and commits it. Every teammate who clones the repo automatically gets the project link.

# Team lead (one time, then commit):
npx @sprintra/cli@latest link --project=proj-XXXXXXXX
git add .sprintra/project.json
git commit -m "chore: bind repo to Sprintra project proj-XXXXXXXX"
git push

# Each teammate clones — auto-detects on first Claude Code session:
git clone <repo>
cd <repo>
cat .sprintra/project.json   # already there from the clone
npx @sprintra/cli@latest login    # one-time per machine — paste their personal token
claude                            # next session shows [sprintra] briefing automatically

The marker file contains only project_id + project_key — no secrets. Safe to commit.

Per-user MCP tokens

Each teammate authenticates as themselves with their own MCP token. Token scope = (user, org, optionally specific projects).

1. Teammate accepts the org invite at app.sprintra.io
2. Goes to app.sprintra.io/agents and creates a personal MCP token
3. Runs npx @sprintra/cli@latest login on their machine and pastes the token
4. The CLI calls /api/me and caches user identity (user_id, email, display_name) in ~/.sprintra/config.json
5. From this point: every PostToolUse hook fire, every MCP call, every commit attributable to this user

Tokens NEVER live in the repo. Each user's token stays on their machine.

Role-based access

Sprintra has 7 built-in roles with descending permissions:

Roles are assigned per-org or per-project at app.sprintra.io/org/settings. Custom roles available on Team and Enterprise plans.

Self-hosted team setup

For teams that don't use Sprintra Cloud, run ONE shared Sprintra server somewhere all teammates can reach (LAN, Tailscale, or a small VPS) and have everyone point their client at it via SPRINTRA_API_URL.

Option A — LAN (cheapest, fastest)

# On the host machine (e.g. team lead's Mac mini):
npx create-sprintra@latest team-server
cd team-server
HOST=0.0.0.0 PORT=4000 npm start
# Find the LAN IP: ipconfig getifaddr en0 (Mac) or hostname -I (Linux)

# On each teammate's machine:
echo '{"apiUrl":"http://<lan-ip>:4000","token":"<shared-or-per-user-token>"}' > ~/.sprintra/config.json

Option B — Tailscale (works across networks, encrypted)

# Install Tailscale on host + all teammates' machines (https://tailscale.com)
# Host runs server bound to 0.0.0.0:
HOST=0.0.0.0 PORT=4000 npm start
# Teammates find host's tailnet hostname (e.g. team-server.<tailnet>.ts.net)
# Set apiUrl in each teammate's config.json:
echo '{"apiUrl":"http://team-server.your-tailnet.ts.net:4000","token":"..."}' > ~/.sprintra/config.json

Option C — VPS (most reliable, slightly more setup)

# Run Sprintra in Docker on a small VPS (Hetzner, Fly.io, Railway):
# Then teammates point at the public URL with HTTPS:
echo '{"apiUrl":"https://sprintra.your-company.com","token":"..."}' > ~/.sprintra/config.json

For self-hosted authentication, you can use Better Auth (built-in), static MCP tokens, or your own SSO. Enterprise customers get custom auth integration.

Who-did-what attribution

Once Phase 5 hooks are installed (PostToolUse + Stop + SessionEnd), every action attributable to a user via their MCP token. Visible in two places:

• /project/:projectId/executions — chronological log with the agent column showing display name + email
• /project/:projectId/team-activity — per-user 7/30-day stats: tool calls, files touched, top tools, last seen

The PostToolUse hook captures every Claude Code tool call (Read, Edit, Write, Bash, MCP). Personal data stays per-user (Sprintra never sees your file contents — only the file path + tool name).

FAQ