SuprAnalytics

REST API

Read your reports, and send what happens on your server.

Read every report on your dashboard with an account API key. And from your backend, record a goal, a payment or a batch of crawler hits with a website API key: they show up next to what the browser sends.

Start free trial How it works

14-day free trial · No card required · From $9/month

Three endpoints that send.

JSON in, JSON out, under /api/v1.

POST /api/v1/goals
A goal for a visitor, attached to their latest visit, with up to 10 properties. It shows on the dashboard and in the live view, and sends goal alerts.
POST /api/v1/payments
A payment, renewal or refund from any provider or your own billing, credited to the visitor's visits. Sending the same transaction_id again updates it, so retries are safe.
POST /api/v1/crawl
AI and search crawler requests, one hit or up to 100 at a time. Unknown user agents and static files are ignored, so you can forward every request.

Every report, to read.

GET /api/v1/sites lists your websites with their figures, uptime and site score, and GET /api/v1/sites/{id or domain}/{report} answers any report, from overview and goals to retention, peak hours, performance and uptime, with the dashboard's own numbers. It takes an account key (pa_…), which acts with your role and can't change anything. Visitors' personal data is only included for a key made with it. See the read API.

How a payment finds its visitor.

Pass the supr_visitor_id cookie as visitor_id, or the supr_session_id cookie as session_id to credit that exact visit. Without them, the customer's email is matched to a visitor with that email.

  • customer_id credits later payments with the same id to the same visitor
  • renewal: true counts as revenue, not as a new customer
  • refunded: true marks the payment with that transaction_id as refunded
  • Amounts are in major units, like 29.99, in any ISO currency, defaulting to the website's
  • The response says whether the payment was attributed to a visit

Keys and limits.

Use a website API key from the website's Settings → API. Keys start with pk_, belong to one website, and can be named, rolled and deleted, up to 20. Send one as Authorization: Bearer pk_….

Each key can make 3,000 requests a minute; past that, the answer is 429 with a Retry-After header.

Set it up.

  1. Create a website key

    Settings → API of the website, then keep the key in an environment variable on your server.

  2. Read the visitor id

    Take the supr_visitor_id cookie from the incoming request.

  3. Send the event

    POST the goal, payment or crawler hit to /api/v1 with the key as a bearer token.

How it works, in detail.

The docs page “REST API: authentication, errors and rate limits” goes through it step by step.

How it works

Limits worth knowing

  • A website key only sends and an account key only reads, so a key on your server can't read your visitors' emails
  • No CORS, on purpose: call it from your server, never from the browser, so the key stays secret
  • A server goal needs a visitor who has been on the website; one with no visits yet gets a 404
  • Payments can't be deleted, only marked as refunded

Questions, answered.

How do I authenticate?

With a website API key from Settings → API, sent as Authorization: Bearer pk_…. A wrong or missing key gets a 401.

Where do I get the visitor id?

From the supr_visitor_id cookie the script sets on your domain, read from the request on your server. In the browser, window.supr.visitorId() returns it, for passing to a checkout.

What if the same payment is sent twice?

Payments are stored once per transaction_id. Sending it again updates the same payment, and the response says duplicate: true.

Why report crawler hits from my server?

AI assistants and search engines read pages without running JavaScript, so the script never sees them. Forward each request's user agent and path, and the dashboard shows who reads what. See Crawler hits API.

Can I read my stats with the API?

Yes. The read API returns every report on the dashboard with an account API key, and AI assistants can use the MCP server. Visitors' personal data is only included for a key given it.

Is there a command-line tool?

Yes. The CLI shows your websites' traffic, revenue, uptime and what to fix in your terminal, with --json for scripts.

More features

All features

See it on your own website.

Every feature is on every plan, with a free trial and no card.

Start free trial

14-day free trial · No card requiredPricingHow it worksAll features