Browse developer documentation
Get started
Authentication and permissions
Choose a workspace key or OAuth grant for the operation you need.
Send credentials in a header
Authenticated REST endpoints accept Authorization: Bearer TOKEN. Workspace keys can also use x-attriboo-key. Do not put credentials in query strings. List websites first so every request uses the intended workspace and site.
Workspace keys begin atb_live_. OAuth access tokens begin atb_oat_. The shared workspace key can read all workspace reports and make supported event/payment writes. There are no per-website or read-only workspace API keys.
Authorization: Bearer $ATTRIBOO_TOKENChoose the least access needed
OAuth approval is for a selected workspace. The account holder completes sign-in and approval. Optional website setup requires a new approval for analytics:read sites:write and current workspace owner/admin access. Refreshing an existing report-only grant does not add setup access.
| Credential | Read reports | Website setup | Events, payments, crawls |
|---|---|---|---|
| Workspace key | Yes | No | Yes |
| OAuth analytics:read | Yes | No | No |
| OAuth analytics:read sites:write | Yes | Owner/admin only | No |
| No credential | No | No | Only the public tracker routes described separately |
Rotate or disconnect access
Regenerate a workspace key in Settings → API & MCP. The old key stops working immediately; update every server, plugin and tool that used it. Key regeneration does not disconnect separately approved OAuth apps.
Disconnect OAuth apps under Connected AI apps, or revoke their token through the OAuth endpoint. Access tokens last one hour; refresh tokens rotate and expire after 90 days. Save the replacement refresh token after each refresh.
Keep report data private
The report API is intended for server-side clients. It does not provide a general cross-origin browser API. Never expose a workspace key in a browser bundle. The public tracker uses a website ID and has a different collection contract.
Sales can contain customer emails and visitor identifiers. Store and display these only to people authorized to read the workspace.