Skip to main content
An API key authenticates programmatic access to tinyanalytics — server-side event ingestion, analytics reads, and site management. You create a key in your account settings, then send it on every request as a Bearer token:

​
Create and manage keys

Keys are managed from your account settings:
  • A key is shown once at creation — copy it then, because tinyanalytics stores only a hash and can’t show it again.
  • Revoke a key any time to cut off its access immediately.
  • A key inherits its owner’s access: a request authenticates as the user who created the key, and is authorized by that user’s organization membership and team access. A key never grants more than its owner has.
Treat an API key like a password. A leaked key can read and manage every site its owner can access — so keep it server-side, never ship it in browser code, and revoke it if it’s exposed. Browser tracking doesn’t need a key; the data-site-id in the snippet is enough.

​
Where the key is required

​
Sending the key

Always send the key in the Authorization header — never in the URL. A key in a query string leaks into server logs, browser history, and referrer headers.

​
Frequently asked questions

No. A key is shown once at creation, because tinyanalytics stores only a hash of it. If you didn’t copy it, create a new key in your account settings and revoke the old one.
No — always send it in the Authorization header as Bearer YOUR_API_KEY. A key in a query string leaks into server logs, browser history, and referrer headers.
A key inherits its owner’s access, so a leaked key can read and manage every site its owner can access. Revoke it immediately in your account settings to cut off that access. Keep keys server-side and never ship one in browser code — browser tracking needs no key, since the data-site-id in the snippet is enough.

Tracking API

Use a key for server-side ingestion.

Rate limits & CORS

The per-key ingestion limit.

Account settings

Where you create and revoke keys.

API playground

Try the API with your key.

MCP server

Use the same key to connect an AI agent.

Related topics

API Rate Limits and CORSAnalytics Read APItinyanalytics API Reference