# Projects and DSN

> Each app is one project with its own DSN. How to create a project, find the DSN, rotate or revoke keys and set intake limits.

A **project** is one app — a website, an API, a Worker. Every project has its own DSN, issues, limits and settings. A **workspace** groups your projects, team, alerts and the one node they all send to.

## Create a project

1. Open **Projects → New project**.
2. Enter a name. Belvador suggests an address (slug) from it.
3. Pick the platform. It decides which setup guide the project page shows:

| Platform in Belvador | Use it for | Guide |
|---|---|---|
| JavaScript (browser) | Browser JavaScript without React | [JavaScript in the browser](https://belvador.dev/en/docs/sdk/browser) |
| React (Vite / SPA) | React apps that render in the browser | [React](https://belvador.dev/en/docs/sdk/react) |
| TanStack Start / Lovable | TanStack Start apps on Cloudflare Workers, including Lovable apps | [TanStack Start](https://belvador.dev/en/docs/sdk/tanstack-start) |
| Node.js | Node.js servers | [Node.js](https://belvador.dev/en/docs/sdk/node) |
| Python | Python apps | [Python](https://belvador.dev/en/docs/sdk/python) |
| Other | Cloudflare Workers, and any other Sentry-compatible SDK | [Cloudflare Workers](https://belvador.dev/en/docs/sdk/cloudflare) |

Members, admins and owners can create projects.

> [!TIP]
> Use one project per deployable app. If a web app and its API share a project, their issues mix and they share one rate limit. A TanStack Start app is one project: its browser and server parts use the same DSN.

## The DSN

The DSN tells an SDK where to send errors:

```text
https://<public-key>@ingest.belvador.dev/<project-id>
```

It holds a 32-character public key and the project's number. You find it on the project page next to the setup guide, and the setup code already contains it.

The DSN is **public by design**: anyone who sees it can send errors to the project, so it is protected by rate limits and allowed origins, not secrecy. It is fine in browser code. It never contains a password or secret — do not add one.

## DSN keys: new, rotate, revoke

**Project settings → DSN keys** lists each key with its label, status (**Active**, **Stops …**, **Revoked**, **Expired**), when it was created and last used.

| Action | What happens |
|---|---|
| **New key** | A second active key, for example one per environment. Update the DSN in the app that should use it. |
| **Rotate** | Creates a new key; the old one keeps working for **24 hours**, so you can deploy the new DSN without losing errors. |
| **Revoke** | The edge stops accepting the key **within a minute**. Apps still using it stop sending errors. This cannot be undone. |

Creating and revoking keys asks for your authenticator code ([re-verification](https://belvador.dev/en/docs/account-security#re-verification-for-sensitive-actions)).

## Allowed origins

**Project settings → Allowed origins** limits which websites may send errors with this project's keys. Enter one origin per line, such as `https://app.example.com`. Empty means any site.

This only applies to browsers, which send an `Origin` header. Server SDKs are not affected. Only owners and admins can change it.

## Intake limits

**Project settings → Intake limits** caps how fast the project can send:

- **Events per second** and **Burst** apply to the project across all its keys. Leave them empty to use the plan default; you can lower them, not exceed the plan.
- The workspace also has a **monthly limit** counted in envelopes (one envelope usually carries one error event).

**Intake, last 24 hours** shows what the edge counted, updated every minute: **Received**, **Rate-limited**, **Over monthly quota**, **Not supported yet** (for example tracing data), **Too large**, **Blocked by origin**, **Lost (buffer expired)** and **Rejected as invalid**. Use it to tell whether errors are being sent at all — see [Troubleshooting](https://belvador.dev/en/docs/troubleshooting).

## Other project settings

- **General** — the name, and **Pin on Fleet** to keep the project at the top of [Fleet](https://belvador.dev/en/docs/fleet).
- **Upload tokens** — tokens for uploading [source maps](https://belvador.dev/en/docs/source-maps) from CI.
- **Data protection** — which groups of sensitive data your node masks before storing. See [Data protection](https://belvador.dev/en/docs/privacy).
- **Environments** — every environment the node has seen (from the SDK's `environment` option). Hide one to leave it out of default filters.

## Delete a project

**Project settings → Delete project** asks you to type the project's address and confirm with your authenticator code. Then:

1. In 24 hours every DSN key and upload token of the project stops working.
2. The node deletes all errors, issues and source maps of the project.
3. Until then any owner or admin can choose **Cancel deletion**.

Only owners and admins can delete projects.