Skip to main content
Every call carries an API key in the Authorization header. A key starts with hs_live_.

​
Create a key

In the dashboard, open Workspace settings › API keys and choose New API key. Name the key after whatever will use it, then pick the sites it reads:
  • Every site, sites added later included
  • Only the sites I pick
The dashboard shows the key once. Copy it before you close the dialog. A key belongs to its workspace, not to the member who created it, so it keeps working after that member leaves. Describe the API key returns the workspace and the sites a key reads.

​
Keep the key secret

A key reads your stats, so keep it on a server or in a script’s environment, never in a web page. The site id in your tracker snippet is public, and the API never accepts it in place of a key.

​
Delete a key

Delete a key in Workspace settings › API keys. A call made with it then answers 401 with the code UNAUTHORIZED, as a call with no key does. A workspace whose reports are closed until it pays keeps its keys. Their calls answer 403 with the code FORBIDDEN until the workspace pays again, except Get the event usage, which keeps answering.