> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sequenzy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create Web Tracking Key

> Create a publishable key and get the install snippet for your site

Create a publishable key for the browser tracking SDK and get the `<script>` tag to install.

This is what turns on product views, cart activity, and browse abandonment for a site that is not Shopify or WooCommerce. Events start flowing once the snippet is deployed, and nothing is backfilled for the period before that - create and install it before building the sequence that depends on it.

Requires an API key with the `integrations:manage` scope.

## Request

<ParamField body="name" type="string" required>
  Human-readable label, e.g. `Storefront`.
</ParamField>

<ParamField body="allowedOrigins" type="array">
  Origins allowed to use this key. A bare domain is read as `https`. A leading
  `*.` matches subdomains at any depth but not the apex. Maximum 50 entries.
  Omitting this leaves the key unrestricted, so any site can send events with it

  * a deliberate choice for a native app or server-side caller only.
</ParamField>

```bash theme={null}
curl -X POST "https://api.sequenzy.com/api/v1/web-tracking-keys" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Storefront",
    "allowedOrigins": ["https://example.com", "https://*.example.com"]
  }'
```

## Behavior

Origins are normalized before storage: case is lowered, paths and trailing slashes are stripped, and default ports are dropped so the stored value matches what a browser sends in `Origin`.

If any entry cannot be parsed as an origin, the whole request is rejected rather than saving the valid subset - a partial save would leave you believing a domain is covered when it was silently dropped.

After installing the snippet, [mint an identity token](/api-reference/web-tracking-keys/mint-identity) from your authenticated backend and call `sequenzy.identify(email, identityToken)` when a visitor signs in or reaches checkout. Until then, their events are buffered in their browser. See [Website Tracking](/concepts/web-tracking).

## Responses

<ResponseExample>
  ```json 200 theme={null}
  {
    "success": true,
    "key": {
      "id": "wtk_abc123",
      "name": "Storefront",
      "publicKey": "seq_pk_hR8xQ2mK9vL4nP7wT1yZ6cB3dF5gJ0sA",
      "allowedOrigins": ["https://example.com", "https://*.example.com"],
      "isActive": true,
      "unrestricted": false,
      "lastUsedAt": null,
      "createdAt": "2026-08-17T10:00:00.000Z",
      "updatedAt": "2026-08-17T10:00:00.000Z",
      "installSnippet": "<script>(function(w){var q=w.sequenzy=w.sequenzy||[];[\"identify\",\"track\",\"viewedProduct\",\"addedToCart\",\"removedFromCart\",\"viewedCart\",\"viewedCollection\",\"searched\",\"reset\"].forEach(function(m){q[m]=q[m]||function(){q.push([m].concat(Array.prototype.slice.call(arguments)));};});})(window);</script><script async src=\"https://api.sequenzy.com/sequenzy.js\" data-sequenzy-key=\"seq_pk_hR8xQ2mK9vL4nP7wT1yZ6cB3dF5gJ0sA\" data-sequenzy-company=\"comp_123\" data-sequenzy-endpoint=\"https://api.sequenzy.com\"></script>",
      "endpoint": "https://api.sequenzy.com/api/webhooks/commerce/api/comp_123/customer-events"
    },
    "message": "Web tracking key created. Paste installSnippet into every page, mint an identity token from your backend, then call sequenzy.identify(email, identityToken)."
  }
  ```

  ```json 400 theme={null}
  {
    "error": "allowedOrigins contains entries that are not valid origins: *.com. Use a scheme and host such as https://example.com, or https://*.example.com for subdomains."
  }
  ```

  ```json 401 theme={null}
  {
    "error": "Missing API key. Provide via x-api-key header or Authorization: Bearer <key>"
  }
  ```

  ```json 403 theme={null}
  {
    "error": "API key is missing required scope: integrations:manage"
  }
  ```
</ResponseExample>