Settings
Settings is where you configure how your organization works and customize your own account. There are two areas: Organization Settings control tenant-wide behavior, while Personal Settings apply only to you.
Organization Settings
Organization settings are available to administrators. They control how the tenant operates for everyone.
General
Go to Organization Settings → General to update your organization's basic information.
| Field | Description |
|---|---|
| Organization Name | The name shown throughout the application. |
| Timezone | The timezone used for scheduling and reporting. |
Click Save to apply changes.
Email
Go to Organization Settings → Email to choose how your organization's email is delivered. Its Senders page, beneath Email in the settings menu, chooses who that email comes from.
Sending services
A sending service is the account your audience email goes out through, such as workflow emails and sign-in links. Click Add sending service, choose a service, give it a name you'll recognize, and enter its credentials:
| Service | What you need |
|---|---|
| Amazon SES | An access key ID and secret access key with SES send permissions, and the region (e.g. us-east-1). |
| SMTP | The host, port, encryption, and the username and password if your server requires them. |
| Postmark | A server API token, and optionally a message stream. |
| Resend | An API key. |
You can add more than one. Choose the one your organization uses in Default sending service; the first one you add becomes the default. Individual properties can choose a different one.
The table lists each sending service with what uses it — the organization default and any properties. Click a name to edit it, or Send test to send a test message through it before you make it the default.
Allegro stores credentials encrypted and never shows them again. When you edit a sending service, leave a credential blank to keep the saved one.
Workflow emails only go out through your own sending service. Until your organization (or the property an email is sent as) has one, workflows that send email can't be published, and Send email steps are skipped. Sign-in emails and other account email send from Allegro until you add one.
A sending service that's in use can't be deleted. Choose another default, or change the properties that use it, first.
For Amazon SES, make sure the IAM user has the ses:SendRawEmail permission in
the configured region.
Senders
Go to Organization Settings → Email → Senders. A sender is a From name and address, with an optional Reply-To address, that your email goes out as. Click Add sender and fill in:
| Field | Description |
|---|---|
| From name | The display name recipients see in their inbox (e.g. Acme News). |
| From address | The address email is sent from (e.g. news@acme.com). Your sending service must allow sending from it. |
| Reply-to address | Optional. Where replies go instead of the From address (e.g. editors@acme.com). |
You can add as many senders as you like, such as one per newsletter or desk. Choose the one your organization uses in Default sender; the first one you add becomes the default. The default is used for sign-in emails and for workflow emails that don't choose a sender of their own. Individual properties keep their own senders and default.
The table lists each sender with what uses it: the organization default and any published workflows that send as it. Click a name to edit or delete it. A sender that's the default, or that a published workflow sends as, can't be deleted. Choose another default, or change those workflows, first.
Send a test email
Click Send test next to a sender to send a short test message from it to your own email address, through your default sending service. If the sending service rejects the message, for example because the From address isn't verified with it, the error is shown to you directly rather than failing silently in the background.
Login Providers
Go to Organization Settings → Login Providers to set up OAuth login for your audience members. Each provider shows whether it is Enabled or Not configured.
Supported providers include Google, Apple, Facebook, and GitHub.
Setting Up a Provider
Each provider requires a Client ID and Client Secret (and sometimes additional fields). To configure one:
- Create an OAuth application in the provider's developer console.
- Copy the Redirect URL shown on the Login Providers page and add it as an authorized redirect URI in your OAuth app.
- Enter the credentials into the corresponding fields and click Save.
Once saved, the provider badge changes to Enabled and audience members can sign in with that provider.
Organizations that run multiple properties can override these providers per property — using a property's own OAuth app, reordering them, or hiding one on a specific property. See Properties → Login Providers.
Encrypted fields such as Client Secret show a masked placeholder once saved. To update a secret, enter a new value. To remove a saved secret, use the remove it link below the field.
Apple Sign In
Apple Sign In requires a few extra steps compared to other providers:
- Client ID — Your Apple Services ID (e.g.
com.example.allegro). This is the Service ID you create in the Apple Developer portal, not your App ID. - Client Secret — A signed JWT you generate using a private key downloaded from Apple. Apple client secrets have a maximum lifetime of 6 months and must be regenerated before they expire.
When your client secret is approaching expiration, generate a new one in the Apple Developer portal and update it in Organization Settings → Login Providers → Apple.
GitHub Sync
Go to Organization Settings → GitHub Sync to connect a GitHub repository as the template source for your organization. When connected, templates sync automatically on every push to the configured branch.
For full setup instructions — including creating the GitHub App, configuring environment variables, and the installation flow — see the GitHub Sync guide.
Managing an Existing Connection
Once connected, the page shows:
| Detail | Description |
|---|---|
| Connected Account | The GitHub account or organization the app is installed under. |
| Repository | The full repository name (e.g. org/repo) being synced from. |
| Default Branch | The branch that triggers syncs on push. |
| Last Sync | Timestamp and short commit SHA of the most recent sync. |
From this page you can:
- Sync Now — Manually trigger a sync (rate-limited to once every 5 minutes).
- Change Repository — Opens the GitHub App settings to adjust which repositories are accessible.
- Disconnect — Stops syncing. Existing templates remain but become editable.
Disconnecting does not delete your templates. However, if you later connect a
new repository to an organization that already has templates, Allegro will
permanently delete all existing templates to replace them with the repository
contents. You must type DELETE to confirm this action.
Latest Sync Status
Below the connection details, Allegro shows the most recent sync status:
| Status | Meaning |
|---|---|
| Pending / Running | The sync job is queued or actively processing. |
| Success | All templates were synced from the repository. |
| Failed | The sync encountered an error. The error message is shown below the status. |
Warnings (e.g. skipped files) are also listed when present.
Packages
Go to Organization Settings → Packages to manage which integration packages are enabled for your organization. Packages are grouped by category.
Check or uncheck a package to enable or disable it, then click Save.
Packages marked with a Global badge are always enabled and cannot be toggled from this page.
Developer Tools
The Developer Tools section groups settings that are relevant to technical integrations and local development — API keys, GitHub template sync, the embed snippet, preview CSS, and webhooks. It appears at the bottom of the Organization Settings sidebar, below the Access & Identity section (login providers, OAuth clients, and the sign-in page).
API Keys
Go to Organization Settings → API Keys to create and manage the API keys your organization uses to authenticate with the Allegro REST API.
API keys belong to the organization, not to an individual user. Everyone who manages them sees the same shared list, and a key keeps working as people join or leave the team. Managing keys requires the Admin role — members without it cannot view or change this page.
An organization API key only works against its own organization. A key from one organization is rejected if it is used against another organization's domain.
Creating a key
- Click Create Key and give it a descriptive name (e.g.
data-pipeline). - Choose when the key should expire — 30 days (the default), 90 days, 1 year, a custom date, or Never. A dated key stops working at the end of the chosen day, so prefer a dated expiry over Never wherever you can.
- Choose the scopes the key should carry.
- Confirm. The generated key value is shown once — copy it now, because it is never displayed again.
Managing existing keys
Each key in the list shows its name, the scopes it carries, when it was created, when it expires (or Never), and when it was last used (or Never). A key approaching its expiry date is highlighted, and one that has already lapsed is marked Expired. From the list you can:
- Edit a key to rename it, change its expiration, or change its scopes.
- Revoke a key to stop it working immediately. Revoked keys cannot be recovered.
An expired key stops working on its own and can no longer be edited. There is no way to extend it — create a new key to replace it.
Creating, updating, and revoking keys is recorded in an activity log on the page — showing who made each change and when — so the organization has a clear audit trail.
Treat API keys like passwords. Do not share them or commit them to source control. If a key is compromised, revoke it immediately and create a new one.
Embed Snippet
Go to Organization Settings → Embed Snippet to inject custom JavaScript into
every page that loads the Allegro SDK via client.js. The snippet is appended
to the loader and executes after the SDK initializes.
A typical snippet uses the event queue to run code on every page load:
window.allegro.push((allegro) => {
// Runs after Allegro initializes on every page
});
Every save creates a new revision. You can browse the diff history and restore any previous version from the Version History panel on the same page.
The snippet is cached as part of client.js for up to 5 minutes. Changes may
not appear on your site immediately after saving.
For more details on how the snippet is served and how to use it, see the Script Tag guide.
Preview CSS
Go to Organization Settings → Preview CSS to add custom CSS that is applied when previewing templates with the Allegro Preview tool. This lets you approximate the look of your site's stylesheet without having to embed Allegro in a live page.
This field accepts CSS only. Allegro rejects any value containing a <
character, so markup such as a <style> tag cannot be saved here.
GitHub Template Sync
Go to Organization Settings → GitHub Sync to connect a GitHub repository as the source for your interaction templates. When connected, templates sync automatically on every push to the configured branch.
For full configuration details, see the GitHub Sync section above.
Personal Settings
Personal settings apply only to your own account. They do not affect other users in your organization.
Profile
Go to Personal Settings → Profile to update your account details.
| Field | Description |
|---|---|
| Name | Your display name shown throughout the application. |
| Email address | The email address used to sign in and receive notifications. |
Click Save to apply changes.
If your email address has not been verified, a prompt appears with a link to resend the verification email.
Your profile page also contains an option to permanently delete your account. This action cannot be undone.
Password
Go to Personal Settings → Password to change your account password.
Enter your current password, then provide a new password and a matching confirmation. Click Save password to apply.
Use a long, randomly generated password. A password manager can help you generate and store one securely.
Two-Factor Authentication
Go to Personal Settings → Two-Factor Authentication to enable or disable 2FA on your account.
Enabling 2FA
- Click Enable 2FA. A setup modal appears with a QR code.
- Scan the QR code with a TOTP-compatible authenticator app (such as Google Authenticator, Authy, or 1Password). If you cannot scan the code, a manual setup key is also provided.
- Enter the one-time code from your authenticator app to confirm setup.
Once enabled, you are prompted for a TOTP code on every login.
Recovery Codes
After enabling 2FA, you can view your recovery codes. Store these somewhere safe — they let you regain access if you lose your authenticator device.
Disabling 2FA
When 2FA is enabled, a Disable 2FA button appears. Click it to remove the two-factor requirement from your account.
Disabling 2FA reduces the security of your account. Only disable it if you have a specific reason to do so.
Appearance
Go to Personal Settings → Appearance to control the color scheme of the Allegro admin interface.
| Option | Description |
|---|---|
| Light | Always use the light theme. |
| Dark | Always use the dark theme. |
| System | Follow your operating system's light/dark mode preference. |
Your preference is saved automatically when you select an option.
Related Links
- Users — manage team members and invitations
- Permissions — understand roles and what each can access