> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sequenzy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List Web Tracking Keys

> List publishable keys for the browser tracking SDK

List the publishable keys that let your website send on-site events into this workspace.

Each key includes a paste-ready install snippet and the origins it is allowed to run on. A key whose `lastUsedAt` is `null` has not successfully authenticated an event yet. The snippet may be undeployed, the site may not have sent an instrumented event, or the origin allowlist may be rejecting its requests.

Shopify stores do not use these keys. They use the [storefront pixel](/api-reference/integrations/pixel-get).

Requires an API key with the `integrations:manage` scope.

## Request

This endpoint takes no parameters.

```bash theme={null}
curl "https://api.sequenzy.com/api/v1/web-tracking-keys" \
  -H "Authorization: Bearer YOUR_API_KEY"
```

## Response fields

<ResponseField name="keys" type="array">
  Keys in this workspace, newest first.
</ResponseField>

<ResponseField name="keys[].publicKey" type="string">
  The publishable key. It ships in your page source, so it is not secret; it
  authorizes storefront events only.
</ResponseField>

<ResponseField name="keys[].allowedOrigins" type="array">
  Normalized origins allowed to use this key. Empty means any origin.
</ResponseField>

<ResponseField name="keys[].unrestricted" type="boolean">
  True when the allowlist is empty, so any site can send events with this key.
</ResponseField>

<ResponseField name="keys[].isActive" type="boolean">
  False when the key has been revoked. Revoked keys are rejected at ingest.
</ResponseField>

<ResponseField name="keys[].lastUsedAt" type="string">
  When the key last authorized an event, or `null` if it never has. Updated at
  most every five minutes.
</ResponseField>

<ResponseField name="keys[].installSnippet" type="string">
  The exact `<script>` tag to paste into every page. Embeds both the key and
  the workspace id.
</ResponseField>

<ResponseField name="keys[].endpoint" type="string">
  Ingest URL the SDK posts to. Useful for debugging in a network tab.
</ResponseField>

## Responses

<ResponseExample>
  ```json 200 theme={null}
  {
    "success": true,
    "keys": [
      {
        "id": "wtk_abc123",
        "name": "Storefront",
        "publicKey": "seq_pk_hR8xQ2mK9vL4nP7wT1yZ6cB3dF5gJ0sA",
        "allowedOrigins": ["https://example.com", "https://*.example.com"],
        "isActive": true,
        "unrestricted": false,
        "lastUsedAt": "2026-08-17T09:12:00.000Z",
        "createdAt": "2026-08-01T10:00:00.000Z",
        "updatedAt": "2026-08-01T10:00:00.000Z",
        "installSnippet": "<script>(function(w){var q=w.sequenzy=w.sequenzy||[];[\"identify\",\"track\",\"viewedProduct\",\"addedToCart\",\"removedFromCart\",\"viewedCart\",\"viewedCollection\",\"searched\",\"reset\"].forEach(function(m){q[m]=q[m]||function(){q.push([m].concat(Array.prototype.slice.call(arguments)));};});})(window);</script><script async src=\"https://api.sequenzy.com/sequenzy.js\" data-sequenzy-key=\"seq_pk_hR8xQ2mK9vL4nP7wT1yZ6cB3dF5gJ0sA\" data-sequenzy-company=\"comp_123\" data-sequenzy-endpoint=\"https://api.sequenzy.com\"></script>",
        "endpoint": "https://api.sequenzy.com/api/webhooks/commerce/api/comp_123/customer-events"
      }
    ]
  }
  ```

  ```json 401 theme={null}
  {
    "error": "Missing API key. Provide via x-api-key header or Authorization: Bearer <key>"
  }
  ```

  ```json 403 theme={null}
  {
    "error": "API key is missing required scope: integrations:manage"
  }
  ```
</ResponseExample>