API Keys

An API key lets something run against your TrueTracked data without you sitting there: an n8n workflow, a nightly script, a CI job, or your own code. These cannot complete a browser login, so they carry a key instead.

If you are connecting Claude, ChatGPT or Claude Code, you do not need a key. Those log in through the browser. See the MCP Connector guide instead.

Create a Key

1. Open your Profile, then the API Keys tab. There is also an API Keys link in dashboard settings that takes you to the same place.
2. Click New API key and give it a name describing where it will run, for example "n8n nightly report". The name is how you know what you are revoking six months from now.
3. Choose when it expires. Never is the default, because an unattended job that dies at 3am with no warning is worse than a key you can revoke in one click.
4. Copy the key. It starts with tt_.

The Endpoint

One URL, the same one the AI connector uses:

https://mcp.truetracked.com/mcp

Send your key as either header, whichever your tool supports. Both work exactly the same:

Authorization: Bearer tt_your_key_here

X-API-Key: tt_your_key_here

n8n

1. Add an MCP Client Tool node.
2. Set the endpoint to https://mcp.truetracked.com/mcp
3. Choose Bearer authentication and paste the key, or Header authentication with the name X-API-Key and the key as the value.
4. The node fetches the available tools automatically. Wire it into your agent or workflow as normal.

curl, or Your Own Code

List everything the connector can do:

curl https://mcp.truetracked.com/mcp \
  -H "Authorization: Bearer tt_your_key_here" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Then run one. Start with list_websites, because the website value it returns is what every other tool takes as an argument:

curl https://mcp.truetracked.com/mcp \
  -H "Authorization: Bearer tt_your_key_here" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{
    "jsonrpc":"2.0","id":2,"method":"tools/call",
    "params":{"name":"list_websites","arguments":{}}
  }'

Which comes back as something like this:

{
  "websites": [
    {
      "website": "my-store",
      "name": "My Store",
      "domain": "mystore.com",
      "currency": "GBP",
      "timezone": "Europe/London",
      "role": "admin"
    }
  ]
}

From there, pass "website": "my-store" to any other tool.

The Tools

Fifteen tools, all read-only. The table below is a map so you can see what is possible. Treat tools/list as the authority, not this page: it returns the live schema for every argument, including ones added after this was written.

Rules that apply to every tool

• Dates are optional. Every data tool takes start_date and end_date as YYYY-MM-DD. Omit both and you get the last 30 complete days. Give one and you must give the other.
• Dates are in the website's own timezone, not yours and not UTC. A store in Asia/Dhaka gets its own days.
• Maximum span is 400 days for totals-style tools, and 186 days for anything returning one row per day. Ask for more and the call is rejected rather than silently truncated.
• Every group of numbers carries a basis saying where it came from: platform reported, TrueTracked measured, or blended store. Read it before comparing two figures. They are supposed to differ.
• Prefer the cheap tool. If the question is "what did Meta report as my CPC", get_platform_ad_metrics_daily answers it in a fraction of a second. The attribution tools take several seconds and only one runs at a time.

A worked example

Channel performance for August, on the TrueTracked attribution model:

curl https://mcp.truetracked.com/mcp \
  -H "Authorization: Bearer tt_your_key_here" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{
    "jsonrpc":"2.0","id":3,"method":"tools/call",
    "params":{
      "name":"get_platform_performance",
      "arguments":{
        "website":"my-store",
        "start_date":"2026-08-01",
        "end_date":"2026-08-31"
      }
    }
  }'

Call list_attribution_models to see the values attribution_model accepts, and list_metrics for the metric names, rather than guessing them.

Claude Code with a Key

Claude Code accepts a key, but the browser login is the better option there:

claude mcp add --transport http truetracked https://mcp.truetracked.com/mcp \
  --header "Authorization: Bearer tt_your_key_here"

Some versions of Claude Code have a bug where the header is used when checking the connection but dropped on the actual requests. The result is a connector that reports itself as connected while every question fails. If you see that, remove it and add it again without the header, then run /mcp and choose Authenticate.

Limits

• 10 keys per person. Revoke one to create another.
• 5 new keys per hour.
• 60 requests per minute per key. Your plan's overall limit still applies on top, and is the one you are more likely to meet.
• Only one heavy report runs at a time across the whole connector. Campaign and platform performance queries are genuinely expensive. If you are polling on a schedule, space the requests out rather than firing them together.

When Something Fails

Revoking a Key

Delete it from Profile > API Keys. It stops working on the very next request, with nothing cached and no delay.

Every key shows when it was last used, so an unused key or one being used when you did not expect it is easy to spot. If a key has leaked, revoke it first and investigate afterwards. Creating a replacement takes seconds.

FAQ