feat: seed deterministic project token for demo data

[joshsny]

Problem

When you run generate_demo_data locally we seed the Hedgebox demo team and a fixed personal API key (DEV_API_KEY), but the project's API token (api_token, the phc_... value) is random on every run. That means anything that wants to send events into the demo project — local SDK setups, the hedgebox-dummy app, scripts — has to look up the freshly generated token each time instead of hardcoding a known value.

Changes

• generate_demo_data now assigns the demo team a deterministic project API token, phc_localposthogprojecttoken, but only on the fresh-account path (not when targeting an existing --team-id or resetting the master project).
• Because api_token is unique, the token is first released from any team that claimed it on a previous run (reassigned a random token), so re-running the command always hands the predictable token to the latest demo team.
• Threaded an optional api_token argument through MatrixManager.ensure_account_and_save → create_team; it defaults to None, so the signup and eval-data-setup callers are unaffected.
• The completion output now prints the project API token alongside the login link and password.

How did you test this code?

I'm an agent. I syntax-checked the changed files; ruff and the app runtime aren't available in this environment, so I did not run the command or the test suite. The change is additive and gated behind the new-account branch — existing callers pass no api_token and keep the random default.

Automatic notifications

• Publish to changelog?
• Alert Sales and Marketing teams?

Docs update

🤖 Agent context

Authored by PostHog Code (Claude) at the request of the repo owner. The ask was to make the demo project token deterministic (phc_localposthogprojecttoken) only for generate_demo_data, mirroring how DEV_API_KEY is fixed locally.

Key decisions:

• Scoped the deterministic token to the new-account branch only, leaving --team-id / master-project flows and the signup/eval callers on the random default by making the new api_token parameter optional.
• Handled the unique-constraint collision on re-runs by releasing the token from the prior holder before creating the new team, rather than catching IntegrityError, so the freshest demo team always owns the predictable token.

---

Created with PostHog Code

[github-actions]

Hey @joshsny! 👋

It looks like your git author email on this PR isn't your @posthog.com address (joshua@timenavi.com). Since you're on the PostHog team, it's worth pointing your local git author email at your @posthog.com address. Why it matters:

• Consistent work identity in git history — internal tooling that attributes commits to team members keys off your @posthog.com address.
• Keeps team contributions easy to tell apart from external community ones when scanning history.

You can fix it for this repo with:

git config user.email "you@posthog.com"

Or set it globally with git config --global user.email "you@posthog.com". No need to redo this PR — just a nudge for next time. 🙂

[greptile-apps]

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
posthog/management/commands/generate_demo_data.py:178-191
**Non-atomic token release and team creation**

The `Team.objects.filter(...).update(...)` that releases the old token runs outside the `transaction.atomic()` block inside `ensure_account_and_save`. If the process is killed — or `ensure_account_and_save` raises an unexpected (non-`ValidationError`) exception — between these two calls, `DEMO_PROJECT_API_TOKEN` is orphaned: no team holds it, and the newly created team will receive a random token instead. The next successful run will self-heal because the `filter` returns empty and the new team gets the deterministic token, but a partial failure on the current run leaves the dev environment in an inconsistent state until re-run.

_{Reviews (1): Last reviewed commit: "feat: seed deterministic project token f..." | Re-trigger Greptile}

[Copilot]

Pull request overview

This PR makes the locally seeded demo project easier to target by assigning a deterministic project API token (phc_localposthogprojecttoken) when generate_demo_data creates a fresh demo account, and it threads an optional api_token through MatrixManager.ensure_account_and_save into team creation.

Changes:

• Add a fixed demo project API token and attempt to “release” it from any prior team before creating a new demo team.
• Extend MatrixManager.ensure_account_and_save to accept an optional api_token and pass it through to create_team.
• Print the project API token in the command’s completion output.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
posthog/management/commands/generate_demo_data.py	Adds deterministic token assignment/release and prints token on completion.
posthog/demo/matrix/manager.py	Threads optional api_token into demo team creation.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[gantoine]

nice!

[github-actions]

🎭 Playwright report · View test results →

⚠️ 2 flaky tests:

• Inline editing insight title via compact card popover (chromium)
• Save an insight, make changes, discard them, and save a copy (chromium)

These issues are not necessarily caused by your changes.
Annoyed by this comment? Help fix flakies and failures and it'll disappear!

[deployment-status-posthog]

Deploy status

Environment	Status	Deployed At	Workflow
dev	✅ Deployed	2026-06-01 21:57 UTC	Run
prod-us	✅ Deployed	2026-06-02 10:18 UTC	Run
prod-eu	✅ Deployed	2026-06-02 10:20 UTC	Run