A free website stats API for your own dashboards

You can get your website analytics data as JSON over HTTPS with the Clicktag Stats API. Every account can query overview totals, hourly or daily time series, 10 breakdown dimensions and browser retention for ranges up to 400 days, plus a rolling 31-day summary of all its sites. Public sites need no token, and private sites take a Firebase ID token or a management key in the Authorization: Bearer header.

What you can read from the API

Clicktag exposes the same numbers that power its web dashboard. You send a GET request with Unix timestamps in seconds (from and to) and an IANA timezone name (tz, which defaults to UTC), and you get back JSON.

• Overview totals and time series: pageviews, visitors (distinct daily visitor hashes), median duration in seconds for pageviews lasting at least 5 seconds, a 5-minute live visitor count, the previous period's numbers and a zero-filled series array bucketed by hour (up to 4 days) or day (up to 400 days). When your range reaches into the current hour or day, the response also carries a forecast object.
• Overview summary: one request for the lists below the main chart, including top devices, browsers and operating systems, custom event counts and top event names, and the pages visitors had open in the last 30 minutes.
• Breakdowns: up to 1,000 rows for any of 10 dimensions (pages, referrers, countries, devices, browsers, os, utm_sources, utm_mediums, utm_campaigns, events). Add spark=1 to get per-bucket arrays on every row, or sort=rising to rank rows by growth over the previous period using a Poisson margin instead of raw percentages.
• Filters: overview, overview summary and breakdown queries take up to 12 f=<key>:<value> parameters (up to 256 characters per value) so you can narrow a report to a country, referrer, UTM tag or custom event.
• Retention: new and returning browsers, a daily series, weekly first-visit cohorts (weeks start Monday) across up to 12 follow-up weeks and a retention curve with best and worst cohort shares.
• All-sites summary: one call that returns every verified website and API site on your account, with a 5-minute live count, a rolling 31-day daily traffic history and daily request and 5xx error counts for API analytics sites.

Pageview, visitor and event counts exclude bots, and read requests are not rate limited.

Stats API endpoints at a glance

All paths below sit under https://clicktag.io.

Authentication and management keys

How you authenticate depends on whether the site is public or private. If you mark a verified site public (is_public), anyone can call its overview, overview summary, breakdown and retention endpoints without an Authorization header. Anonymous reads on public sites are cached at the edge for 60 seconds.

For private sites, or when you want uncached owner reads and account-wide summaries, you send a bearer token. While you're testing, you can copy a short-lived Firebase ID token (valid for about an hour) from the authentication docs. For scripts, cron jobs and servers, create a long-lived management key under Workspace settings > API keys.

Management keys start with tt_mk_ followed by 48 lowercase hex characters, and one key works across every site in your account (up to 50 websites per account). You can keep up to 10 active management keys at once and assign three independent scopes:

1. read for GET requests across stats, site lists, goals, Search Console data and AI crawler reports.
2. manage for creating or updating sites, goals, email reports, alert rules and site API keys.
3. ingest for sending backend request metrics to POST /api/ingest with the X-Totallytics-Site header.

Here is a bash example from the docs that reads a management key from your terminal and fetches the last 7 days of overview stats for a site:

read -rsp "Clicktag management key: " TT_MANAGEMENT_KEY && export TT_MANAGEMENT_KEY
EA_HOSTNAME='shop.example.com'

from=$(( $(date +%s) - 7 * 86400 ))
curl -H "Authorization: Bearer $TT_MANAGEMENT_KEY" \
  "https://clicktag.io/api/sites/$EA_HOSTNAME/overview?from=$from"

Ways to use the stats API

Because responses are plain JSON and reads have no rate limit, you can wire your traffic numbers into whatever tools you already run.

• Internal dashboards and admin panels: pull /api/sites/summary or /overview from your backend to show traffic charts alongside product signups or server metrics for SaaS analytics.
• Client reporting: if you run analytics for agencies, one tt_mk_ key with the read scope lets a script pull monthly pageviews, top referrers and rising pages across up to 50 client sites without logging into each one.
• Slack or chat bots: schedule a daily job that queries /breakdown?dim=referrers&sort=rising or /overview/summary and posts your fastest-growing traffic sources and top custom events to a team channel.
• Spreadsheets and custom exports: Clicktag doesn't have a separate HTTP export endpoint, so if you want more than the dashboard's traffic CSV, fetch series or breakdown rows in a script and write them straight to a sheet or database.

Limits to know before you build

A few boundaries are worth checking before you write your client code:

• Server-side calls only: responses under https://clicktag.io/api/* don't include cross-origin CORS headers, even for public sites. Call the API from a backend server, a serverless function or a CLI script, not from browser JavaScript on another domain.
• No event metadata in responses: event tracking stores custom event metadata on collection, but the stats API cannot return, group by or filter on metadata. Put any value you need to break down or filter into the event name itself (up to 256 characters).
• Three UTM dimensions: utm_sources, utm_mediums and utm_campaigns are breakdown dimensions and filter keys, while utm_term and utm_content are not reported.
• No pagination offsets: breakdowns return up to 1,000 rows per query without cursors or total-row counts, and date ranges cap at 400 days (from and to in Unix seconds, not milliseconds).

FAQ

Is the Clicktag stats API free?

Yes. Clicktag is completely free, with no credit card required and no paid tier today. You can track up to 50 websites per account and create up to 10 active management keys at no cost.

Can I call the stats API directly from browser JavaScript?

No. Product API endpoints (https://clicktag.io/api/*) do not send CORS headers, even when a site is marked public. Fetch the data from your own server, a cron job or a serverless function instead.

Can I break down or filter by custom event metadata?

No. Event metadata (up to 4,096 characters) is saved when you send an event, but it isn't returned, grouped or filtered in the dashboard or the stats API. If you need to count or filter by a property in the events breakdown, include it in the event name.

Why are utm_term and utm_content missing from the breakdown dimensions?

Clicktag only groups and filters UTM parameters by utm_source, utm_medium and utm_campaign. utm_term and utm_content are not report or API dimensions.

What happens if I send an invalid management key to a public site?

Clicktag validates a management key before looking up the site's visibility. Even on a public site, an unknown or revoked tt_mk_ key returns 401 invalid or revoked management key, and a key without the read scope returns 403 scope read required. To read a public site anonymously, omit the Authorization header completely.