Security & API access

The Security & API tab holds the two things that decide whether Spectry accepts data for this site.

Allowed domains

Data is only accepted from origins on this list. This prevents someone copying your snippet onto another site and polluting your analytics.

List every hostname the site is served from, including subdomains you actually use (www.example.com and example.com if both resolve), and staging domains if you want staging traffic tracked. If tracking works locally but not in production, a missing domain here is the first thing to check.

Write key

The write key identifies your site to the ingestion API. It appears in the tracking snippet and is sent as the X-Spectry-Key header on server-side calls.

The write key is public by design — it is visible in your page source, and it must be, because the browser SDK uses it. It grants write access only: it cannot read your analytics, and it is why the allowed-domains list exists as the actual protection.

Rotating the key

If you need to rotate it, generate the new key, update every snippet and server-side integration, then retire the old one. Traffic still using the old key stops being recorded the moment it is retired, so make the update first.

Dashboard access is separate and never uses the write key — it goes through your login and per-site permissions. See Manage sites & people.