Web Tracking Keys
Create Web Tracking Key
Create a publishable key and get the install snippet for your site
POST
/
api
/
v1
/
web-tracking-keys
Create Web Tracking Key
curl --request POST \
--url https://api.sequenzy.com/api/v1/web-tracking-keys \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"name": "<string>",
"allowedOrigins": [
{}
]
}
'import requests
url = "https://api.sequenzy.com/api/v1/web-tracking-keys"
payload = {
"name": "<string>",
"allowedOrigins": [{}]
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({name: '<string>', allowedOrigins: [{}]})
};
fetch('https://api.sequenzy.com/api/v1/web-tracking-keys', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.sequenzy.com/api/v1/web-tracking-keys",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'name' => '<string>',
'allowedOrigins' => [
[
]
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.sequenzy.com/api/v1/web-tracking-keys"
payload := strings.NewReader("{\n \"name\": \"<string>\",\n \"allowedOrigins\": [\n {}\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.sequenzy.com/api/v1/web-tracking-keys")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"name\": \"<string>\",\n \"allowedOrigins\": [\n {}\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.sequenzy.com/api/v1/web-tracking-keys")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"name\": \"<string>\",\n \"allowedOrigins\": [\n {}\n ]\n}"
response = http.request(request)
puts response.read_body{
"success": true,
"key": {
"id": "wtk_abc123",
"name": "Storefront",
"publicKey": "seq_pk_hR8xQ2mK9vL4nP7wT1yZ6cB3dF5gJ0sA",
"allowedOrigins": ["https://example.com", "https://*.example.com"],
"isActive": true,
"unrestricted": false,
"lastUsedAt": null,
"createdAt": "2026-08-17T10:00:00.000Z",
"updatedAt": "2026-08-17T10:00:00.000Z",
"installSnippet": "<script>(function(w){var q=w.sequenzy=w.sequenzy||[];[\"identify\",\"track\",\"viewedProduct\",\"addedToCart\",\"removedFromCart\",\"viewedCart\",\"viewedCollection\",\"searched\",\"reset\"].forEach(function(m){q[m]=q[m]||function(){q.push([m].concat(Array.prototype.slice.call(arguments)));};});})(window);</script><script async src=\"https://api.sequenzy.com/sequenzy.js\" data-sequenzy-key=\"seq_pk_hR8xQ2mK9vL4nP7wT1yZ6cB3dF5gJ0sA\" data-sequenzy-company=\"comp_123\" data-sequenzy-endpoint=\"https://api.sequenzy.com\"></script>",
"endpoint": "https://api.sequenzy.com/api/webhooks/commerce/api/comp_123/customer-events"
},
"message": "Web tracking key created. Paste installSnippet into every page, mint an identity token from your backend, then call sequenzy.identify(email, identityToken)."
}
{
"error": "allowedOrigins contains entries that are not valid origins: *.com. Use a scheme and host such as https://example.com, or https://*.example.com for subdomains."
}
{
"error": "Missing API key. Provide via x-api-key header or Authorization: Bearer <key>"
}
{
"error": "API key is missing required scope: integrations:manage"
}
Create a publishable key for the browser tracking SDK and get the
<script> tag to install.
This is what turns on product views, cart activity, and browse abandonment for a site that is not Shopify or WooCommerce. Events start flowing once the snippet is deployed, and nothing is backfilled for the period before that - create and install it before building the sequence that depends on it.
Requires an API key with the integrations:manage scope.
Request
string
required
Human-readable label, e.g.
Storefront.array
Origins allowed to use this key. A bare domain is read as
https. A leading
*. matches subdomains at any depth but not the apex. Maximum 50 entries.
Omitting this leaves the key unrestricted, so any site can send events with it- a deliberate choice for a native app or server-side caller only.
curl -X POST "https://api.sequenzy.com/api/v1/web-tracking-keys" \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"name": "Storefront",
"allowedOrigins": ["https://example.com", "https://*.example.com"]
}'
Behavior
Origins are normalized before storage: case is lowered, paths and trailing slashes are stripped, and default ports are dropped so the stored value matches what a browser sends inOrigin.
If any entry cannot be parsed as an origin, the whole request is rejected rather than saving the valid subset - a partial save would leave you believing a domain is covered when it was silently dropped.
After installing the snippet, mint an identity token from your authenticated backend and call sequenzy.identify(email, identityToken) when a visitor signs in or reaches checkout. Until then, their events are buffered in their browser. See Website Tracking.
Responses
{
"success": true,
"key": {
"id": "wtk_abc123",
"name": "Storefront",
"publicKey": "seq_pk_hR8xQ2mK9vL4nP7wT1yZ6cB3dF5gJ0sA",
"allowedOrigins": ["https://example.com", "https://*.example.com"],
"isActive": true,
"unrestricted": false,
"lastUsedAt": null,
"createdAt": "2026-08-17T10:00:00.000Z",
"updatedAt": "2026-08-17T10:00:00.000Z",
"installSnippet": "<script>(function(w){var q=w.sequenzy=w.sequenzy||[];[\"identify\",\"track\",\"viewedProduct\",\"addedToCart\",\"removedFromCart\",\"viewedCart\",\"viewedCollection\",\"searched\",\"reset\"].forEach(function(m){q[m]=q[m]||function(){q.push([m].concat(Array.prototype.slice.call(arguments)));};});})(window);</script><script async src=\"https://api.sequenzy.com/sequenzy.js\" data-sequenzy-key=\"seq_pk_hR8xQ2mK9vL4nP7wT1yZ6cB3dF5gJ0sA\" data-sequenzy-company=\"comp_123\" data-sequenzy-endpoint=\"https://api.sequenzy.com\"></script>",
"endpoint": "https://api.sequenzy.com/api/webhooks/commerce/api/comp_123/customer-events"
},
"message": "Web tracking key created. Paste installSnippet into every page, mint an identity token from your backend, then call sequenzy.identify(email, identityToken)."
}
{
"error": "allowedOrigins contains entries that are not valid origins: *.com. Use a scheme and host such as https://example.com, or https://*.example.com for subdomains."
}
{
"error": "Missing API key. Provide via x-api-key header or Authorization: Bearer <key>"
}
{
"error": "API key is missing required scope: integrations:manage"
}
⌘I
Create Web Tracking Key
curl --request POST \
--url https://api.sequenzy.com/api/v1/web-tracking-keys \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"name": "<string>",
"allowedOrigins": [
{}
]
}
'import requests
url = "https://api.sequenzy.com/api/v1/web-tracking-keys"
payload = {
"name": "<string>",
"allowedOrigins": [{}]
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({name: '<string>', allowedOrigins: [{}]})
};
fetch('https://api.sequenzy.com/api/v1/web-tracking-keys', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.sequenzy.com/api/v1/web-tracking-keys",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'name' => '<string>',
'allowedOrigins' => [
[
]
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.sequenzy.com/api/v1/web-tracking-keys"
payload := strings.NewReader("{\n \"name\": \"<string>\",\n \"allowedOrigins\": [\n {}\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.sequenzy.com/api/v1/web-tracking-keys")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"name\": \"<string>\",\n \"allowedOrigins\": [\n {}\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.sequenzy.com/api/v1/web-tracking-keys")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"name\": \"<string>\",\n \"allowedOrigins\": [\n {}\n ]\n}"
response = http.request(request)
puts response.read_body{
"success": true,
"key": {
"id": "wtk_abc123",
"name": "Storefront",
"publicKey": "seq_pk_hR8xQ2mK9vL4nP7wT1yZ6cB3dF5gJ0sA",
"allowedOrigins": ["https://example.com", "https://*.example.com"],
"isActive": true,
"unrestricted": false,
"lastUsedAt": null,
"createdAt": "2026-08-17T10:00:00.000Z",
"updatedAt": "2026-08-17T10:00:00.000Z",
"installSnippet": "<script>(function(w){var q=w.sequenzy=w.sequenzy||[];[\"identify\",\"track\",\"viewedProduct\",\"addedToCart\",\"removedFromCart\",\"viewedCart\",\"viewedCollection\",\"searched\",\"reset\"].forEach(function(m){q[m]=q[m]||function(){q.push([m].concat(Array.prototype.slice.call(arguments)));};});})(window);</script><script async src=\"https://api.sequenzy.com/sequenzy.js\" data-sequenzy-key=\"seq_pk_hR8xQ2mK9vL4nP7wT1yZ6cB3dF5gJ0sA\" data-sequenzy-company=\"comp_123\" data-sequenzy-endpoint=\"https://api.sequenzy.com\"></script>",
"endpoint": "https://api.sequenzy.com/api/webhooks/commerce/api/comp_123/customer-events"
},
"message": "Web tracking key created. Paste installSnippet into every page, mint an identity token from your backend, then call sequenzy.identify(email, identityToken)."
}
{
"error": "allowedOrigins contains entries that are not valid origins: *.com. Use a scheme and host such as https://example.com, or https://*.example.com for subdomains."
}
{
"error": "Missing API key. Provide via x-api-key header or Authorization: Bearer <key>"
}
{
"error": "API key is missing required scope: integrations:manage"
}