Security updates for the Account and Analytics APIs
The Account API now supports proper API keys, instead of requiring your account's username and password. Furthermore, both this and the Analytics API now support POST requests.
Story time
Clicky launched November 29, 2006. That's 20 years ago. Pre-iPhone. Pre-brainrot. Most websites didn't even have fucking HTTPS yet, because Cloudflare and Let's Encrypt weren't around yet to make it easy and free (plus, HTTPS was painfully slow until HTTP/2 launched in 2015). But really, no one cared because it was just normal back then to blast your login credentials everywhere in plain text.
Imagine sending an evil version of Claude back in time to this happy-go-lucky world full of rainbows and lollipops. Judgment Day would have happened within milliseconds. 🤖
Back then, we had no money, and we didn't even have a CDN, so we did everything we could to make sure these requests would get cached by reverse proxies. POST requests don't get cached, so we were more than happy to use GET. That was intentional. I persnally also find GET convenient for testing and bug hunting during development, since you can make API calls directly in your browser... but that's me.
This is all just context for the world that Clicky and its APIs were born into. None of it is a valid excuse for how it was still "the way" in 2026, but we're here now, and there's no time like the present.
The new User API key
This post is mostly about the new user API key, so let's get to it. Head over to your user preferences page and you'll find it under the "Authentication" section. Then you can make requests to the API as follows:
GET: https://api.clicky.com/api/account/sites?userkey=YOUR_USER_KEY
POST: curl -d "userkey=YOUR_USER_KEY" https://api.clicky.com/api/account/sites
This new user API key is independent of your password, so you can change one without affecting the other, and all of your integrations should keep working (which was not true before).
The user key also works when using Sign in with Google, which disables your password and hence disables password-based API access entirely. Before today, Google sign-in users were just SOL.
Existing integrations
Existing integrations aren't yet unaffected, but we are deprecating the username/password method for the Account API now, and it will be removed entirely in the near future. If you use this API, update your integrations as soon as you can. We'll email every account that's using that API before anything actually happens.
The Analytics API is a tougher call, but for now at least, we're planning to keep GET support indefinitely. The important part of this update is that we now support POST requests, so you stop using GET immediately if desired.