Integrations
How conversion tracking works, and everything your account needs to run it.
Tokens & security
Two kinds of token authenticate your traffic, and four controls keep that traffic yours: allowed domains, request signing, IP allow-lists and rotation.
Keys the browser pixel. Meant to be visible in your page source — not a secret. Re-viewable any time; disable or rotate without touching your other tokens.
- Visibility
- Public — visible in page source
- Used by
- Browser pixel
- Sent as
- ?publicToken= query param
- Secret shown
- Not a secret · re-viewable
Authenticates server postbacks. The secret is shown only once when created or rotated, so store it securely and never expose it in the browser.
- Visibility
- Secret — server-side only
- Used by
- Server postback
- Sent as
- Authorization: Bearer …
- Secret shown
- Once, at create / rotate
Allowed domains
Each public token can include a domain allow-list. Events sent from pages on unapproved domains are silently discarded. The pixel still receives an empty success response, preventing attackers from learning which domains are allowed through probing.
An empty list allows all domains. Entries include subdomains, so example.com also covers shop.example.com.
Request signing (HMAC)
A private token can include an HMAC secret. Your server sends X-Timestamp and X-Signature (a hex HMAC-SHA256 of the timestamp, newline, and raw body). We verify both and reject mismatches, so the bearer token alone is not enough.
The X-Timestamp must be within a short tolerance of server time, which bounds replays; dedupKey then keeps an accepted conversion counted once.
IP allow-list
A private token can be restricted to a set of IP addresses or CIDR ranges. Postbacks from any other address are rejected regardless of credentials.
Combine with signing for defence in depth: the allow-list stops stray callers, the signature proves the payload came from you.
Rotation
Rotate a token whenever a secret may have leaked, when someone with access leaves, or on your regular security schedule. Rotation invalidates the old value immediately.
Keep two tokens per surface during planned rotations: add the new one, deploy, then revoke the old — zero downtime.