Skip to main content
Browser tracking is deliberately keyless and available from any site origin. Private analytics reads and management calls require an API key and accept browser requests only from trusted origins.

​
Browser collection needs no API key

The tracking script sends pageviews, events, and identity updates directly from the visitor’s browser. The snippet’s data-site-id identifies the site, and the script supplies page context automatically. Use the browser event API and browser identity API. Never add an API key to the page.

​
CORS rules

TinyAnalytics splits browser access into two zones: This lets the tracking script run on your visitors’ pages while preventing an unrelated site from reading private analytics through a signed-in browser. A state-changing private request from an untrusted origin returns 403.
CORS is not a safe place to hide an API key. Any credential shipped in client-side JavaScript can be read by a visitor even when the origin is allowed.

​
API-key creation limit

Creating API keys is limited to 10 attempts per signed-in user per hour. Invalid request bodies count toward the same security window. When the limit is reached, TinyAnalytics returns 429 Too Many Requests with Retry-After. If the shared security limiter is unavailable, key creation returns 503 instead of creating an unbounded key.

​
MCP request limit

Calls to the MCP server are limited to 120 requests per minute per API key. Beyond that, the endpoint returns 429 Too Many Requests with a Retry-After header. Building a dashboard, where each card is previewed before it is saved, typically uses 30–60 calls over a few minutes.

​
Frequently asked questions

No. The installed tracking script and every window.tinyanalytics collection method are keyless.
Do not embed an API key in frontend code. Use the TinyAnalytics dashboard for interactive browser access, or keep programmatic data access in a trusted environment where the key is not exposed to visitors.
Private analytics and management endpoints accept browser requests only from trusted origins. An untrusted origin receives 403 even if the browser has a TinyAnalytics dashboard session.
The MCP endpoint returns 429 Too Many Requests with Retry-After. Wait for that interval before retrying.

Browser event API

Send events from client-side code without a key.

Browser identity API

Identify users and update traits from the browser.

API keys

Create least-privilege credentials for private API access.

API reference

Choose between browser collection and the HTTP data API.

Related topics

Set up a first-party analytics proxyTinyAnalytics Account SettingsWebsite Heatmaps: Click, Rage-Click, and Scroll Maps