diff --git a/.env.development b/.env.development
index ad05caff..0be66bb4 100644
--- a/.env.development
+++ b/.env.development
@@ -6,6 +6,7 @@ CONNECT_CLIENT_SECRET=connect_client_secret # can be found on scalingo
 CONNECT_URL=connect_url # can be found on scalingo
 DATABASE_URL=postgresql://postgres:postgres@localhost:5432/ngc # no default
 JWT_SECRET=your_secret
+MATOMO_SECURE_TOKEN=matomo_token # can be found on scalingo
 MATOMO_TOKEN=matomo_token # can be found on scalingo
 MATOMO_URL=matomo_url # can be found on scalingo
 NODE_ENV=development
diff --git a/src/config.ts b/src/config.ts
index 2da3c2d7..49919fcf 100644
--- a/src/config.ts
+++ b/src/config.ts
@@ -47,6 +47,7 @@ export const config = {
     matomo: {
       url: ensureEnvVar(process.env.MATOMO_URL, 'https://stats.data.gouv.fr'),
       token: ensureEnvVar(process.env.MATOMO_TOKEN, ''),
+      secureToken: ensureEnvVar(process.env.MATOMO_SECURE_TOKEN, ''),
     },
     redis: {
       url: ensureEnvVar(process.env.REDIS_URL, 'redis://localhost:6379'),
diff --git a/src/routes/stats/statsRoute.ts b/src/routes/stats/statsRoute.ts
index 8600226c..ee1b767c 100644
--- a/src/routes/stats/statsRoute.ts
+++ b/src/routes/stats/statsRoute.ts
@@ -1,4 +1,5 @@
 import apicache from 'apicache'
+import axios from 'axios'
 import type { NextFunction, Request, Response } from 'express'
 import express from 'express'
 import { config } from '../../config'
@@ -43,7 +44,6 @@ router
   .get(
     cache('1 day'),
     async (req: Request, res: Response, next: NextFunction) => {
-      let url
       try {
         const rawRequestParams = decodeURIComponent(
           req.query.requestParams as string
@@ -62,28 +62,23 @@ router
 
         const authorizedMethod = authorizedMethods.includes(matomoMethod)
 
-        const authorizedSiteId = requestParams.get('idSite') === '153'
-
-        if (!authorizedMethod || !authorizedSiteId) {
+        if (!authorizedMethod) {
           res.statusCode = 401
           return next('Error. Not Authorized')
         }
 
-        url =
-          config.thirdParty.matomo.url +
-          '?' +
-          requestParams +
-          '&token_auth=' +
-          config.thirdParty.matomo.token
-
         console.log('will make matomo request', requestParams)
 
-        const response = await fetch(url)
+        requestParams.set('idSite', '20')
 
-        const json = (await response.json()) as {
-          label: string
-          subtable: { url: string }[]
-        }[]
+        const { data: json } = await axios.post<
+          {
+            label: string
+            subtable: { url: string }[]
+          }[]
+        >(config.thirdParty.matomo.url + '?' + requestParams, {
+          token_auth: config.thirdParty.matomo.secureToken,
+        })
 
         // Remove secret pages that would reveal groupe names that should stay private
         if (rawRequestParams.includes('Page')) {