# Spaces (/docs/organizations/spaces)

A **Space** is one site or project of your Organization. An Organization with a shop and a help centre has two. Every product works in Spaces: a site's tests and flags in Improve, its content model and entries in Content, its events in Numbers and its files in Media all live in the same one. Open a Space in one product and the others open on it too.

Spaces are managed on www, on the Organization's **Spaces** tab: every product's Space menu ends with **Manage spaces**, which leads there.

## Environments [#environments]

Each Space has three environments: `develop`, `staging` and `production` (shown as "live"). Improve, Content and Numbers keep a separate copy of their data in each: a test started in staging isn't running in production, and staging's page views don't count in production's reports. Media's files are shared by a Space's environments.

Each product picks the environment it opens in on its own. Content starts in production, Improve in staging.

## Creating and renaming [#creating-and-renaming]

Admins and developers create a Space with **New space**, and name it after the site it's for. Each product sets up its part the first time you open the Space there.

Renaming one, under **General** on its page, keeps its **slug**: links and sites that use it keep working.

## The Space's page [#the-spaces-page]

Each Space has a page on www with what more than one product reads. Admins and developers change it; everyone else sees it.

| Section                   | What it's for                                                                     |
| ------------------------- | --------------------------------------------------------------------------------- |
| **Open in**               | Opens the Space in each product                                                   |
| **Connect a site**        | The Organization and Space ids, and the site's `.env` per environment             |
| **Allowed origins**       | Which sites may call Improve and Numbers from a browser                           |
| **Shopify**               | The Space's store, used by Content, Media and Improve                             |
| **Connected deployments** | Vercel deployments and GitHub Actions workflows that sign in without an API token |
| **General**               | Its name                                                                          |
| **Danger zone**           | Moving it to another Organization, or deleting it (admins)                        |

### Connect a site [#connect-a-site]

The ids and the `.env` a site needs, per environment, for every product the Organization uses. None of them are secret. The API tokens are left for you to fill in: make them in each product, under **API tokens**, where they show once. On Vercel, paste each environment's file into **Project Settings → Environment Variables**: production into Production, staging into Preview, develop into Development. See [A site's .env](/docs/ecosystem#a-sites-env).

### Allowed origins [#allowed-origins]

Which sites may load Improve's datafile and send events to Numbers from a visitor's browser, one list per environment. A site that isn't listed is refused.

- An origin exactly: `https://www.example.com`.
- Any port with `:*`: `http://localhost:*`.
- Subdomains with a `*` at the start of the host: `https://*.example.com`.

`develop` starts with `http://localhost:*` and `http://127.0.0.1:*`. **Allow any origin** lets every site in, and asks you to confirm it for production. Up to 50 origins per environment; a change reaches the products within about a minute.

<Callout type="warn">
	A `*` on a shared host such as `*.vercel.app` lets other people's sites in
	too. End the label with your team: `https://my-project-*-my-team.vercel.app`.
</Callout>

### Shopify [#shopify]

Connect the Space's Shopify store with **Connect store**, or from the Obelism app in your Shopify admin. One store per Space, used by every environment: Content picks its products and collections, Media tags them on photos, and Improve tests the storefront. **Move or disconnect** moves the store to another Space. The store's domain isn't added to the allowed origins for you.

### Connected deployments [#connected-deployments]

A deployment on **Vercel**, or a **GitHub Actions** workflow, can reach Improve and Content with the identity token its host gives it, instead of an API token you store and rotate. Add one with **Connect a deployment**: its host, its ids (a Vercel team and project, or a repository), and a rule per host environment:

- **Its environment**: a Vercel environment (`production`, `preview`, `development`, a custom one, or `any`), or a GitHub environment or ref.
- **Space environment**: which of the Space's environments it reaches.
- **Content**: off, published only, published and drafts, or management (with the content model, the content or both).
- **Improve and Numbers**: allowed or not.

Drafts are only read when a request asks for them. Management acts as whoever granted it, with their role. A change, or disconnecting, takes effect within about a minute. Each product's SDK has the helpers: `vercelOidc()` and `githubOidc()`.

## Transferring a Space [#transferring-a-space]

**Move to another organization**, in the Danger zone, moves the Space with everything in it to another Organization you're an admin of, in every product: content, files, tests, flags, audiences and events. Its id stays the same, and so do its API tokens, webhooks, allowed origins and Shopify store, so sites keep working.

- Only an admin of both Organizations moves a Space, and both have to be active. Type its name to confirm.
- An Organization's **first** Space can't be moved: sites that name only the Organization use it.
- Roles per Space don't move along: in the new Organization its members have their Organization role in it.
- Its slug stays, unless the new Organization already has it: then it gets `-2`.
- Usage counted before the move stays with the old Organization.

## Deleting a Space [#deleting-a-space]

**Delete this space**, in the Danger zone, deletes the Space in every product: its content, files, tests, flags, audiences, events and API tokens. Sites reading it stop working at once. Admins delete Spaces, typing the name to confirm; agents can't.

- An Organization's last Space can't be deleted: create another one first.
- Nor can the only Space of a member restricted to it: give them another first.

<Callout type="warn">
	Deleting a Space can't be undone. Export what you want to keep from each
	product first, or move the Space to another Organization.
</Callout>

## For agents [#for-agents]

`createSpace`, `renameSpace`, `transferSpace`, `updateSecurity` (allowed origins), `listConnections`, `saveConnection` and `deleteConnection` are www's own tools on the [MCP server](/docs/agents/mcp), with the same rights as on the page. `updateSecurity` won't allow any origin in production: a person does that here.