Docs / Observability and data
PostHog
Connect PostHog with OAuth, choose the permissions and projects, and let the agent query product analytics.
The PostHog connector lets the agent run HogQL queries and read analytics objects in the PostHog projects you choose. You authorize it with OAuth and pick exactly which permissions Pangea requests.
Connect
- As a team Administrator, open Connectors → Connect → PostHog.
- Enter a Label, for example
production-analytics. - Pick the Region of your PostHog account: US Cloud or EU Cloud.
- Choose the permissions. Start from Read only or Read & write, then adjust each resource.
- Click Connect with PostHog and approve the request in your browser. On PostHog's consent screen, choose which projects to share.
- Back in Pangea, choose the projects the agent may query and click Save. At least one project must stay selected. You can select up to 50.
Don't paste a PostHog project API key (the public ingestion key). The connector only uses the OAuth grant.
Permissions
Pangea always requests user:read and project:read, which the connect flow needs. Every other permission is your choice, per resource:
| Resource | Access |
|---|---|
| Queries (HogQL / SQL over events, persons, sessions) | Read |
| Insights, dashboards, cohorts, actions, annotations, notebooks | Read or write |
| Event and property definitions | Read or write |
| Feature flags, experiments, surveys | Read or write |
| Persons, session recordings | Read or write |
| Error tracking, Hog functions | Read or write |
The default is read-only. Some write permissions affect real users:
- Changing a feature flag changes production behaviour.
- Launching or stopping an experiment or survey changes what users see.
- Write access to persons or recordings can permanently delete them.
To change permissions later, open the connection's details and click Edit permissions. PostHog asks you to approve the new set. The current grant stays active until PostHog approves the new one. If the connection shows Reconnect required, use Reconnect PostHog to approve the same permissions again.
Changing the selected projects in Pangea is separate from the OAuth permissions. You can narrow projects at any time without reconnecting.
What the agent can do for you
Select the connection in a conversation, then ask things like:
- "How many weekly active users did we have over the last 8 weeks?"
- "Build a signup-to-checkout funnel for last month."
- "What's the rollout of the
new-pricingflag?"
The agent stays within the granted permissions and asks for your confirmation before any write. Review the exact project and change before you approve it.
To check the connection, ask for the available projects and a small, bounded query on one of them. Check the project, time range and event meaning before you treat a count as a product metric.
Troubleshooting and removal
After a permission error, check the region, the selected projects and the granted permissions. Fix it with Reconnect PostHog or Edit permissions. Never paste a token into the chat.
Team Administrators can limit who uses the connection with a member allow-list. To end access, remove the connection in Pangea and revoke the grant in PostHog. Query results already in conversations remain.
See PostHog API scopes for what each permission allows.