The API

Everything the dashboard shows, as JSON. The web app uses the same API and nothing else, so there is nothing it can read that a token cannot.

A token

Make one under Settings, API tokens. Say what it may do (read figures, send events from a backend, manage sites, read and delete visitor records) and which sites; it is shown once, and stored only as a hash. It never does more than the member who made it.

Asking

Every address starts with /api/v1, and the token goes in a header:

curl -H "Authorization: Bearer $TIDEKEEPER_TOKEN" \  "https://tidekeeper.example/api/v1/sites/your-site.example/stats?metrics=visitors,views&by=source&period=7d"

Every answer says what was left out and how the visitors were counted, as the dashboard does. Every answer also says how much of the hour's allowance is left:

RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

Events from a backend

curl -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \  -d '{"name": "Order", "url": "https://your-site.example/checkout", "props": {"plan": "Tide"}}' \  https://tidekeeper.example/api/v1/sites/your-site.example/events

An event sent this way is held to the same rules as one the script sends.

Every endpoint

The full description, in OpenAPI 3, is at /api/v1/openapi.json. Read it with any OpenAPI viewer, or give it to a program that writes a client.