Docs

curl -X POST https://howmanyusers.wtf/api/v1/events \
  -H "Authorization: Bearer $HMU_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{"event":"user.created","user_id":"usr_123","created_at":"2026-08-08T20:00:00Z"}'

// HowManyUsers — from your server (Node, Next.js, any backend).
// The secret key lives in the environment. NEVER in browser code.
async function hmuUserCreated(user) {
  const res = await fetch("https://howmanyusers.wtf/api/v1/events", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      Authorization: `Bearer ${process.env.HMU_SECRET_KEY}`,
    },
    body: JSON.stringify({
      event: "user.created",
      user_id: user.id,          // a stable id. Never emails or names.
      created_at: new Date(user.createdAt).toISOString(),
      idempotency_key: `signup:${user.id}`, // retrying never counts twice
    }),
  });

  // A 202 IS NOT "IT WORKED": it carries what it rejected inside, and a
  // rejected event looks exactly like success if you never read it.
  const { rejected } = await res.json();
  if (rejected?.length) console.warn("[hmu]", rejected);
}

<!-- HowManyUsers — from the browser. Feeds analytics (device, browser,
     country, referrer). It does NOT count users: only your server can, with the
     secret key, and that is what makes the published number worth anything. -->
<script>
  fetch("https://howmanyusers.wtf/api/v1/events", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      Authorization: "Bearer hmu_pk_live_..._YOUR_PUBLIC_KEY",
    },
    body: JSON.stringify({ event: "page.viewed" }),
  });
</script>