The public API and API keys

What you get

The public API returns the same numbers the dashboard shows — scores, tracked questions with their per-engine results, score history, topics, cited sources and share of voice — as JSON, keyed to your company. It is on Pro, Agency and Enterprise (the api_access capability). The MCP server (Agency, early access) uses the same key. The Google Sheets and Looker Studio feeds use a separate, read-only export token instead.

API keys

Keys live under Settings → Company → API keys. Owners and admins can create and revoke them; other roles see the list but cannot change it.

• Create key — give it a name that says what will use it (weekly report script, MCP server, up to 80 characters). The key is shown once, on creation; copy it then. If you lose it, revoke it and create another.
• Keys start with aeo_live_ and the list shows only the prefix afterwards, with when the key was created and last used.
• Five active keys per company. Revoke one to add another; revoked keys stay listed so their name and last use remain visible.
• Revoke takes effect immediately — anything using the key gets a 401 on its next call.

A key carries the whole account's scope: it is not read-only. Besides the read endpoints, it can track a new question and trigger a check that spends from your on-demand re-check pool (the two POST routes below). Treat it like a password: keep it in a secrets store, never in a shared sheet or a chat with an AI assistant, and give each system its own key so you can revoke one without touching the others.

Authentication

Send the key as an X-API-Key header:

curl -H "X-API-Key: aeo_live_xxxxxxxx" https://api.aeotrack.io/api/v1/domains

The /api/v1 routes take the header only. An API key never goes in a URL: the Google Sheets feeds, which carry their credential in the URL because IMPORTDATA cannot set headers, take the read-only export token instead and refuse an API key.

Endpoints

The two POSTs go through exactly the plan checks, cooldown and pool charging the dashboard's own buttons do, so a script cannot spend more than a person could. Once the monthly pool is used up on a paid plan, further checks are billed at the overage rate shown on the Billing page.

Limits and errors

• 120 requests a minute per key. A 429 means slow down; a dashboard refreshing every minute is well inside the limit, a loop over every question on every site is not — fetch /questions once instead.
• 401 — missing, wrong or revoked key.
• 402 — your plan does not include the API (or the capability a route needs); the response says which plan has it.
• 403 with a message about an export token: the aeo_sheet_ token from the Sheets feed was sent instead of an API key. It only works in the Sheets feed URLs.
• 404 — the domain_id is not on this account.
• Responses for a re-check can take a minute or two while the engines answer.

The Google Sheets feed

Four CSV feeds — scores, questions, sources and share_of_voice — are served per website at https://api.aeotrack.io/exports/sheets/{feed}.csv?domain_id=…&key=aeo_sheet_…, built for IMPORTDATA in Google Sheets and, through a sheet, Looker Studio. The URL carries your company's read-only export token, not an API key, because anyone who can open the sheet can read it. Integrations → Google Sheets & Looker creates the token and builds the formula for you. Columns, refresh and the Looker Studio route are in the Google Sheets and Looker Studio export article.

The MCP server

The MCP server (Agency only, early access) uses the same key, so Claude, Cursor or another assistant can ask your account questions in plain language. The hosted endpoint at https://api.aeotrack.io/mcp takes it as Authorization: Bearer aeo_live_…; a key from a plan below Agency can connect, but every tool returns an error naming the plan.