Skip to main content
An API key authenticates programmatic analytics reads, site management, scoped SQL, and MCP. It is not part of client-side tracking: the browser script and its event and identity methods are keyless. Create either a full-access key or a restricted key with per-resource permissions in Settings → Account, then send it as a Bearer token:

​
Create and manage keys

  • A key is shown once at creation. Copy it then; TinyAnalytics stores only a hash and cannot show it again.
  • Revoke a key any time to cut off its access immediately.
  • A key inherits its owner’s access. Organization membership, role, and team access still apply.
  • Leave Restrict permissions off for full access, or turn it on and select at least one resource for a least-privilege key.

​
Available permissions

Selecting Write also selects Read for that resource when both actions exist. It does not grant access to any other resource. Existing keys created without a permission list remain full-access keys.
For workflows, use Workflows: Read. Creating, editing, publishing, testing, pausing, resuming, archiving, and cancelling require an owner or admin signed in with a dashboard session in workflow version 1.
A restricted key with Sites: Read can list the organizations and sites its owner may access, but organization-list responses omit member rosters. Dashboard sessions and existing full-access keys retain the complete member directory.
Trait data can contain names and emails, so user-trait reads and trait:<key> filters require Users: Read. Trait filters do not run on a public site, share link, or embed.
Treat an API key like a password. Never ship it in browser code, a public bundle, a URL, or a log. Revoke an exposed key immediately. Browser tracking needs no key; the snippet’s data-site-id identifies the site.

​
Where a key is required

​
Send the key safely

Always send the key in the Authorization header, never in the URL. A key in a query string can leak into logs, browser history, and referrer headers.

​
Frequently asked questions

No. Create a new key in account settings and revoke the old one.
No. Use the keyless browser APIs for events and identity. API keys can expose private data and management actions when bundled into client-side code.
A full-access key can use every API capability its owner can access. A restricted key can use its selected resources and actions, still bounded by the owner’s permissions. Revoke either key immediately.
Yes, but only for the same resource. Selecting Goals: Write, for example, also selects Goals: Read; it does not grant access to Funnels, Sites, or another resource.
API-key creation is limited to 10 attempts per signed-in user each hour. Invalid creation requests count toward the same limit. A 429 response includes Retry-After.

Browser event API

Track visitor activity without a key.

API access and CORS

Understand browser origins and documented limits.

Account settings

Create and revoke keys.

API playground

Try data and management endpoints with your key.

MCP server

Connect an AI agent with the same permission model.

Related topics

TinyAnalytics Account SettingsTinyAnalytics Agent Skills for AI Coding AgentsWebsite and API Uptime Monitoring