API authentication changes: User key + POST
The Account API now supports proper API keys, instead of requiring your account's username and password. Furthermore, both this and the Analytics API now support both GET and POST requests.
The new User API key
This post is mostly about the new user API key, so let's get to it. Head over to your user preferences page and you'll find it under the "Authentication" section. Then you can make requests to the API as follows:
GET: https://api.clicky.com/api/account/sites?userkey=YOUR_USER_KEY
POST: curl -d "userkey=YOUR_USER_KEY" https://api.clicky.com/api/account/sites
This new user API key is independent of your password, so you can change one without affecting the other, and all of your integrations should keep working (which was not true before).
And finally, Google Sign-in users can use this API again, since that login method disables your password and hence disables password-based API access. For the last 7 months, these users were just SOL. No more!
GET vs POST
Previously, both of these APIs only supported GET. We have now added long-overdue POST support as well.
For context, Clicky launched November 29, 2006. That's 20 years ago. Pre-iPhone. Pre-brainrot. Most websites didn't even have HTTPS yet, because Cloudflare and Let's Encrypt weren't around yet to make it easy and free (plus, HTTPS was painfully slow until HTTP/2 came around in 2015). It was a mostly carefree time and it was just normal to blast your login credentials everywhere in plain text without a second thought.
We had no money, and we didn't even have a CDN, so we wanted to make sure these requests would get cached by reverse proxies. POST requests don't get cached, so we were more than happy to use GET. That was intentional. It didn't seem like a big deal at all.
This was the world that Clicky and its APIs were born into. None of it is a valid excuse for how it was still "the way" in 2026, but we're here now, and there's no time like the present.
Existing integrations
No immediate impact, but we are deprecating username/password authentication for all APIs today, and it will be removed entirely in the future. If you use any of our APIs, update your integrations as soon as you can. We'll email every account that's using username/password authentication before anything actually happens.