---
title: "Create a web tracking key"
method: POST
path: "/web-tracking-keys"
tags: ["Web Tracking Keys"]
---

# Create a web tracking key

`POST /web-tracking-keys`

Creates a publishable key for the browser tracking SDK and returns the script tag to install. The key ships in page source by design and authorizes storefront events only, never the rest of the API. Events start flowing once the snippet is deployed and nothing is backfilled for the period before that. Always pass allowedOrigins - an empty allowlist accepts events from any site. Requires the integrations:manage scope.

## Request body

- object
  - `name` string, required — Human-readable label, e.g. Storefront.
  - `allowedOrigins` string[] — Origins allowed to use this key. A bare domain is read as https. A leading *. matches subdomains at any depth but not the apex. Omitting this leaves the key unrestricted.

## Response `200`

Key created

- object
  - `success` boolean
  - `key` WebTrackingKey — A publishable key for the browser tracking SDK. The key ships in the customer's page source by design, so it is not a secret; it authorizes storefront customer events only and carries an origin allowlist instead of scopes.
    - `id` string
    - `name` string
    - `publicKey` string — The publishable key, prefixed seq_pk_.
    - `allowedOrigins` string[] — Normalized origins allowed to use this key. Empty means any origin.
    - `isActive` boolean — False when revoked. Revoked keys are rejected at ingest.
    - `unrestricted` boolean — True when the allowlist is empty, so any site can send events with this key.
    - `lastUsedAt` string, date-time, nullable — When the key last authorized an event, or null if it never has. Updated at most every five minutes.
    - `createdAt` string, date-time
    - `updatedAt` string, date-time
    - `installSnippet` string — The exact script tag to paste into every page. Embeds both the key and the workspace id.
    - `endpoint` string — Ingest URL the SDK posts events to.
    - `warning` string — Present only when the key is unrestricted.
  - `message` string

## Other responses

- `400` — Invalid name, or an allowedOrigins entry that is not a valid origin. The whole request is rejected rather than saving the valid subset.
- `401` — Unauthorized
- `403` — API key is missing the integrations:manage scope

---

[API](https://skmtc.net/sequenzy/apis/sequenzy-api.md) · [All operations](https://skmtc.net/sequenzy/apis/sequenzy-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/sequenzy/sequenzy-api/revisions/8fbabe82a04d/schema)