Allowed domains & write key

Two settings in Settings → Security & API protect your site from unauthorised or spoofed data.

Allowed domains

Add a list of domains that are permitted to send data for this site. Requests from any other origin are rejected. This prevents your snippet (and Site ID) from being copied and used to inject data on other sites.

Write key

The write key is an optional secret that signs tracking requests via the X-Spectry-Key header. When set, only requests carrying the correct key are accepted.

<script async>
  (function(s, p, e, c, t, r, y) {
    y = 'YOUR_SITE_ID';
    t = p.createElement(e);
    r = p.getElementsByTagName(e)[0];
    t.async = 1;
    t.src = c;
    t.id = 'spectry-script';
    t.dataset.siteId = y;
    t.dataset.writeKey = 'YOUR_WRITE_KEY';
    r.parentNode.insertBefore(t, r);
  })(window, document, 'script', 'https://cdn.spectry.io/spectry.js?id=YOUR_SITE_ID');
</script>

Rotating the key

1. Click Rotate in Security & API.
2. The old key is invalidated immediately.
3. Update the data-write-key in your snippet to the new value.

Rotating invalidates the old key right away — deploy the new snippet promptly to avoid dropping data.