Skip to content

Register without a browser

Everything below happens over HTTPS. A script, a server or an AI assistant can open an account, get a key, create a site and read back the snippet to install, without anyone opening the dashboard.

Only one step needs a person: reading the six-digit code out of the inbox and handing it back.

1. Ask for a code

POST /api/v1/auth/send-otp

curl -s -X POST https://statable.com/api/v1/auth/send-otp \
  -H "Content-Type: application/json" \
  -d '{"email": "agent@example.com"}'

{"sent": true, "email": "agent@example.com"}

The answer is the same whether or not the address already has an account, so nothing here reveals who is registered.

2. Exchange it for a key

POST /api/v1/auth/verify-otp

curl -s -X POST https://statable.com/api/v1/auth/verify-otp \
  -H "Content-Type: application/json" \
  -d '{"email": "agent@example.com", "code": "123456",
       "accept_terms": true, "key_name": "provisioning bot"}'

The response carries token once. Store it before doing anything else: only a hash is kept, and support cannot recover it.

accept_terms must be true. The acceptance is recorded with the version, the IP and the User-Agent, because an account opened without a browser still needs an evidence trail.

created comes back false when the address already had an account. Nothing is duplicated; the call simply adds a key to it.

3. Create the site

POST /api/v1/sites

curl -s -X POST https://statable.com/api/v1/sites \
  -H "Authorization: Bearer stbl_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com", "timezone": "Europe/Amsterdam"}'

The answer holds the site's numeric site_id and a snippet built for it:

{
  "site_id": 3195799,
  "hash": "07k1eD84d2",
  "script_url": "https://statable.com/js/3195799/s.js",
  "snippet": "<script defer src=\"https://statable.com/js/3195799/s.js\"></script>"
}

Install snippet as it comes back rather than assembling the URL from the id. That is the last step: the site starts counting as soon as the tag is on a page.

What the first key can and cannot do

  • It covers every site on the account and always expires. At registration there is nothing to scope it to, and a credential held by software has to age out. One to 365 days, 90 by default.
  • billing:write is not available here. Asking for it is 400 invalid_scope, never a quiet downgrade: authority that moves money should not follow from proving control of an inbox.
  • Some email zones are refused before a code is sent, so a blocked address never receives mail. See Errors.

Rate limits are the login ones: two codes per address per minute, five per IP per hour, and twenty requests per IP per hour across both routes.

Next steps

  • API keys for the full field list, and for minting further keys over HTTP
  • Manage sites for goals, funnels, tracking features and filters
  • Authentication for permissions, expiry and rotation

Ready to take control of your web analytics? Try Statable free for 30 days. No credit card required, full feature access, built for GDPR. Start your free trial or view a live demo.