Skip to main content
The Users metric counts distinct identified people. Each identity is counted once over the selected period, no matter how many sessions it opened or requests it made. This page explains where identities come from, so you can trust the number and know its limits.

​
Where identity comes from

On every request, Alpic tries to resolve who is calling. Four identity sources exist, checked in this order, and the first one that applies wins:
  1. OAuth identity: if your server uses OAuth authentication, the user is identified by the subject of their access token. This is the strongest signal: one entry per authenticated person.
  2. Client-provided subject: ChatGPT attaches a stable, anonymized identifier for the end user to each request. Alpic uses it when no OAuth identity is present, so ChatGPT users are counted individually even without OAuth.
  3. API key: for requests authenticated with an x-api-key header, the identity is a SHA-256 hash of the key. The dashboard shows a short fingerprint of it, never the key itself.
  4. Bearer token: for opaque bearer tokens that carry no user subject, the identity is a hash of the token.
If none of these apply, the request is anonymous.

​
What this means in practice

  • Anonymous traffic is never counted as users. Alpic does not guess identities from IP addresses, does not fingerprint clients, and does not create synthetic anonymous users. In fact, Alpic never collects IP addresses at all. This is why you won’t see anonymous users from Claude, Cursor, or other clients that do not provide a subject identifier - currently, only ChatGPT provides one. If your Users number looks low compared to Sessions, it usually means most of your traffic is unauthenticated.
  • A shared credential counts as one user. An API key or token used by a whole team appears as a single user, since Alpic has no way to tell the individuals apart.
  • Raw credentials are never stored. API keys and tokens are hashed before anything is written; only the hash is kept.
  • Large counts are approximate. Beyond tens of thousands of users, counts use an approximation algorithm and are displayed with a ~ prefix. The error margin is well under 1%.
  • User metrics have a start date. Unique users, session error rate, and the session list are new metrics that can’t be reconstructed from older data. Charts show a “Tracking started” marker; there is no user data before it.

​
Getting accurate user counts

The quality of your Users metric follows directly from how your server authenticates:
  • OAuth gives you the most accurate picture: every user is counted individually, on every client. See OAuth authentication to set it up.
  • ChatGPT traffic is counted per user even without OAuth, thanks to the client-provided subject.
  • API keys and bearer tokens count credentials, not people. Fine if each key belongs to one person, misleading if keys are shared.
  • No authentication means no user counting at all.