> ## Documentation Index
> Fetch the complete documentation index at: https://tinyanalytics.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# API Authentication Keys

> Create API authentication keys for server-side ingestion, analytics reads, and site management, with the same access as the key owner.

An API key authenticates programmatic access to tinyanalytics — server-side event ingestion, analytics reads, and site management. You create a key in your **account settings**, then send it on every request as a Bearer token:

<CodeGroup>
  ```bash cURL theme={null}
  curl https://dash.tinyanalytics.io/api/sites/1/overview \
    -H "Authorization: Bearer YOUR_API_KEY"
  ```

  ```js JavaScript theme={null}
  await fetch("https://dash.tinyanalytics.io/api/sites/1/overview", {
    headers: { Authorization: "Bearer YOUR_API_KEY" },
  })
  ```

  ```python Python theme={null}
  import requests

  requests.get(
      "https://dash.tinyanalytics.io/api/sites/1/overview",
      headers={"Authorization": "Bearer YOUR_API_KEY"},
  )
  ```
</CodeGroup>

## Create and manage keys

Keys are managed from your account settings:

* A key is **shown once** at creation — copy it then, because tinyanalytics stores only a hash and can't show it again.
* **Revoke** a key any time to cut off its access immediately.
* A key inherits **its owner's access**: a request authenticates as the user who created the key, and is authorized by that user's organization membership and [team](/docs/team-site-access) access. A key never grants more than its owner has.

<Warning>
  Treat an API key like a password. A leaked key can read and manage every site its owner can access — so keep it server-side, never ship it in browser code, and revoke it if it's exposed. Browser tracking doesn't need a key; the `data-site-id` in the snippet is enough.
</Warning>

## Where the key is required

| Use                                                      | Needs a key?                                           |
| -------------------------------------------------------- | ------------------------------------------------------ |
| Browser tracking (the snippet)                           | No — the site ID identifies the site.                  |
| [Server-side ingestion](/docs/api-reference/track-events-api) | Yes — and it enables the real-visitor IP/UA overrides. |
| [Analytics reads](/docs/api-reference/analytics-read-api)     | Yes (unless the site is public).                       |
| [Scoped SQL query](/docs/api-reference/sql-analytics-api)     | Yes.                                                   |
| Site management                                          | Yes.                                                   |
| [MCP server](/docs/api-reference/mcp-server) (AI agents)      | Yes — sent as a request header by your AI client.      |

## Sending the key

Always send the key in the `Authorization` header — never in the URL. A key in a query string leaks into server logs, browser history, and referrer headers.

```
Authorization: Bearer YOUR_API_KEY
```

## Frequently asked questions

<AccordionGroup>
  <Accordion title="I lost my API key — can I see it again?">
    No. A key is shown once at creation, because tinyanalytics stores only a hash of it. If you didn't copy it, create a new key in your account settings and revoke the old one.
  </Accordion>

  <Accordion title="Can I put my API key in a query string?">
    No — always send it in the `Authorization` header as `Bearer YOUR_API_KEY`. A key in a query string leaks into server logs, browser history, and referrer headers.
  </Accordion>

  <Accordion title="What can someone do with a leaked API key?">
    A key inherits its owner's access, so a leaked key can read and manage every site its owner can access. Revoke it immediately in your account settings to cut off that access. Keep keys server-side and never ship one in browser code — browser tracking needs no key, since the `data-site-id` in the snippet is enough.
  </Accordion>
</AccordionGroup>

## Related

<Columns cols={2}>
  <Card title="Tracking API" icon="paper-plane" href="/docs/api-reference/track-events-api">
    Use a key for server-side ingestion.
  </Card>

  <Card title="Rate limits & CORS" icon="shield-halved" href="/docs/api-reference/rate-limits-cors">
    The per-key ingestion limit.
  </Card>

  <Card title="Account settings" icon="gear" href="/docs/tinyanalytics-account-settings">
    Where you create and revoke keys.
  </Card>

  <Card title="API playground" icon="terminal" href="/docs/api-reference/api-playground">
    Try the API with your key.
  </Card>

  <Card title="MCP server" icon="plug" href="/docs/api-reference/mcp-server">
    Use the same key to connect an AI agent.
  </Card>
</Columns>


## Related topics

- [API Rate Limits and CORS](/docs/api-reference/rate-limits-cors.md)
- [Analytics Read API](/docs/api-reference/analytics-read-api.md)
- [tinyanalytics API Reference](/docs/api-reference/tinyanalytics-api.md)