Read API

The dashboard, as JSON.

Starter and Growth. A token from Account. The same visitors, pages, sources, live, and Growth funnels you already see. Not a user graph. Hobby stays the dashboard.

Auth

Plan → Account → Read API → name a token. We show cfa_live_… once. We store a hash. Send it as Authorization: Bearer. 60 reads per minute per token. Revoke on the same page.

Routes

GET /api/v1
GET /api/v1/openapi.json
GET /api/v1/sites
GET /api/v1/sites/:id/overview?range=7d
GET /api/v1/sites/:id/pages
GET /api/v1/sites/:id/sources
GET /api/v1/sites/:id/live
GET /api/v1/sites/:id/funnels   # Growth

range is today, 7d, 30d, 90d, or YYYY-MM-DD..YYYY-MM-DD. f is the same filter string the dashboard puts in the URL. CORS is open for GET and POST. No visitor hashes. Live is last pageview in five minutes — no heartbeat.

curl -sS https://www.cookiefreeanalytics.com/api/v1/sites \
  -H "Authorization: Bearer cfa_live_…"

MCP

Same numbers. POST /mcp is JSON-RPC. Tools: list_sites, get_overview, get_pages, get_sources, get_live, get_funnels — all read-only. Claude, Cursor, ChatGPT, and Grok use OAuth 2.1 on this host (RFC 9728 metadata, PKCE S256). Paste https://www.cookiefreeanalytics.com/mcp. Google signs people into the website — it does not sign the agent into your pageviews. curl can still paste cfa_live_… from Account. How-to. Official Registry name com.cookiefreeanalytics/mcp. In-app directories (Claude Connectors, ChatGPT Plugins) are a separate review; until they list us, paste the URL.

# Cursor / Claude: add https://www.cookiefreeanalytics.com/mcp
# The client discovers OAuth and opens /oauth/authorize.

claude mcp add --transport http cookie-free-analytics \
  https://www.cookiefreeanalytics.com/mcp

What this is not

Not PostHog. Not a dump of pageviews. Export of raw rows stays the JSON button on Account.