Authentication

API Keys vs Site Keys

AttractOS uses two types of keys:

Site Key (ak_...)

Used in the client-side tracking script. Safe to expose publicly. Identifies which site tracking data belongs to.

API Key

Used for server-side API access. Keep this secret. Provides access to read your analytics data via the REST API.

Creating an API Key

1. Go to your Dashboard Settings
2. Click API Keys in the sidebar
3. Click Generate New Key
4. Give your key a descriptive name (e.g., "Production Server")
5. Copy the key immediately—it won't be shown again

Using Your API Key

Include your API key in the Authorization header for all API requests:

curl -X GET "https://attractos.com/api/v1/sites" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"

// Using fetch
const response = await fetch('https://attractos.com/api/v1/sites', {
  headers: {
    'Authorization': 'Bearer YOUR_API_KEY',
    'Content-Type': 'application/json',
  },
});

const data = await response.json();
console.log(data.sites);

import requests

response = requests.get(
    'https://attractos.com/api/v1/sites',
    headers={
        'Authorization': 'Bearer YOUR_API_KEY',
        'Content-Type': 'application/json',
    }
)

data = response.json()
print(data['sites'])

Authentication Errors

If authentication fails, you'll receive one of these error responses:

Security Best Practices

• Never expose API keys in client-side code — Only use site keys in the browser
• Use environment variables — Store API keys in .env files, not in source code
• Rotate keys periodically — Generate new keys and revoke old ones every few months
• Use separate keys per environment — Different keys for development, staging, and production
• Monitor API usage — Check your dashboard for unexpected API activity