Umami separates browser login, API keys and public share tokens
Umami separates browser login, API keys and public share tokens Umami exposes analytics through a web application, an API and optional public share pages. The official authentication documentation distinguishes two self-hosted API methods: API keys, which are recommended, and username-password exchange for a token. It also describes API keys as long-lived credentials that do not expire and can be…
Umami is a web application that offers analytics through a web interface, an API, and optional public share pages. The authentication process in Umami comes in two methods: API keys, which are long-lived and can be revoked individually, and username-password exchange for a token. In November 2026, a ZoomEye query revealed 11,535 instances of Umami applications, highlighting the importance of distinguishing between different credential paths.
API keys are meant for scripts and integrations, and each consumer should have its own key, properly named and deleted after the integration ends. Login tokens and passwords are linked to human sessions, and MFA should be encouraged, while departed users should be promptly removed. Public share links are bearer capabilities that require a narrow set of views and should be reviewed and disabled after a project ends.
The Umami dashboard and administrative API should be isolated behind network or SSO boundaries, with access controls in place for the entire service. A ZoomEye measurement can serve as a starting point for verifying owned instances, but it does not confirm the presence of unauthenticated dashboards or exposed share tokens.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
