Seentics

Integration

API keys

One account key, scoped to what each integration needs. It manages your websites (and, on Agency, your clients) and reads their data, by id.

Creating a key

  • Open any website's Developers → API keys tab and choose New account key.
  • Give the key a name that says where it will be used — you will thank yourself later.
  • Pick its access, and only as much as the integration needs.

The secret is shown once

Only a hash is stored, so the full key cannot be shown again. Copy it when it appears; if you lose it, delete the key and make another.

Access

  • Full access — create and manage websites, and read their analytics, recordings and heatmaps.
  • Read only — list websites and read their data. Cannot change anything.
  • Manage only — create, update and delete websites. Cannot read data.
  • AI assistant (MCP) — read analytics, recordings and heatmaps from Claude, Cursor or another assistant. Cannot change anything. See /docs/mcp.
  • Agency API (Agency accounts) — run the agency workspace from your backend: clients, websites, install checks, branding, embeds and usage. See /docs/agency.
  • Custom — pick the scopes one by one.

Under the hood a key holds scopes: websites:read and websites:write for the Management API, and analytics:read, replays:read and heatmaps:read for the data API, and agency:read and agency:write for the agency API (/api/v1/agency). Each endpoint requires one, and a key without it gets 403. A key can only reach websites in its own account.

Using a key

Send it as an X-API-Key header. Never as a query parameter — URLs end up in server logs, browser history and referrer headers.

bash
curl -H "X-API-Key: $SEENTICS_API_KEY"   "https://app.seentics.com/api/v1/raw/v1/catalogue"
report.js
// websiteId is the id returned when you created the website
const res = await fetch(
  `https://app.seentics.com/api/v1/raw/v1/websites/${websiteId}/analytics/daily-stats`,
  { headers: { 'X-API-Key': process.env.SEENTICS_API_KEY } },
);

The API reference on the Developers → Data API tab shows the required scope beside every endpoint.

Keeping keys safe

  • Keep keys server-side. A key in browser JavaScript is a public key — anyone can read it from the network tab. To show a tenant its own numbers in a page, use an embed link instead.
  • One key per integration, so you can revoke one without breaking the others.
  • Choose the narrowest access. A reporting job does not need to manage websites.
  • The dashboard shows each key's last-used time — a key that has not been used in months is a key to delete.

See the REST API page for base URLs and error codes.

PreviousREST APINextAI assistants (MCP)