Site Key vs Access Key

Your access key is the credential that logs you into the dashboard. Your site key is the identifier embedded in the tracking script on your site. They are separate values with separate jobs, and mixing them up is the most common source of login and recording failures.

What your access key does

The access key is your login credential. It is a 32-character string of lowercase letters and digits — hexadecimal notation — that proves to the server you own this account. You type it into the login form at /login and the server checks whether it matches an account on record. If it matches, you get a dashboard session. If it does not, the form clears and nothing happens.

The access key never appears on your website, in your script tag, or in any public-facing URL. It lives in your password manager, nowhere else. Treat it the same way you would treat a password to your bank: do not share it, do not store it in a Git repository, and do not paste it anywhere that is not the login form.

Because it is 32 hex characters, the access key looks like: a4f8c2e1b9d3071f5a6c4e2d8b1f3a09. That is 32 characters of [0-9a-f] with no hyphens, no spaces, and no uppercase letters in the canonical form. The login form accepts uppercase as well, but lowercase is how the key is issued.

What your site key does

The site key is the value that goes into the data-k attribute of the asset.js script tag. It is a shorter identifier, different in both length and format from your access key. It tells the beacon server which site is sending a visit count, so the server knows which site's totals to increment. The site key routes the incoming beacon — it is not an authentication token.

Because the site key lives in a script tag on your public-facing pages, it is visible to anyone who looks at your page source. That is expected and harmless. A site key that is seen by a third party can be used to send bogus beacons — but the server validates the origin hostname against the registered domain for that key, which limits what a bad actor can do with it. Your dashboard count may receive some noise, but your access key remains safe.

Each site you register gets its own distinct site key. If you have three domains registered in the dashboard, you have three site keys. A beacon carrying the site key for domain A that arrives from domain B is rejected. This is how the server enforces that keys stay on the domains they were issued for.

Why two separate keys exist

The access key and the site key have completely different threat models. The site key is designed to be public — it is in your HTML source, in your CDN-cached responses, in your version control history. Making it identical to your login credential would mean every visitor to your site could log into your dashboard. So the two must be separate.

The access key is designed to be private and is never exposed in the beacon or the page source. When you log in successfully, the server issues a short-lived session cookie for the dashboard. The access key itself is not stored in that cookie — it was only needed to prove identity at login time. You will not see your access key again unless you go to the admin panel to regenerate it.

This two-key structure is common in API-based services: one long-lived secret for authentication, one per-resource identifier for routing traffic. They look superficially similar — both are strings of characters — but their roles, storage requirements, and exposure rules are completely different.

The format difference

Your access key is exactly 32 hexadecimal characters: digits 0–9 and lowercase letters a–f. It contains no hyphens, no spaces, no underscores, and no uppercase. When you count the characters in your access key, you should reach exactly 32. If you count fewer, the key was truncated during copy-paste. If you count more, there is a trailing space or newline.

Your site key has a different format and a different length than your access key. The exact site key for each of your registered sites is shown in Dashboard → Settings → Script tab. The tag shown there already has data-k filled in with the correct value. Copy the entire tag rather than extracting only the key, and you will not mix the two up.

Troubleshooting

If you pasted a key into the data-k attribute of your script tag and visits are not appearing, check whether you accidentally pasted your access key instead of your site key. The access key is 32 hex characters; the site key is a different length. Your site key appears in Dashboard → Settings → Script tab. Copy the full tag from there rather than typing or reconstructing the key by hand.

If you entered a string into the login form and the page simply cleared with no message, you may have entered your site key rather than your access key. The login form expects exactly your 32-character access key. It does not explain what was wrong — the form clears regardless of whether the string was the wrong type of key or a completely invalid string. If you are unsure which string is your access key, check your password manager. The access key is what you received on the confirmation page immediately after checkout.

If both keys are lost, the access key can be regenerated from the admin panel if you can reach it through another means. The site key for each registered domain can be found on the Settings → Script tab inside the dashboard. Only the access key requires a separate recovery step — the site keys remain visible in the dashboard as long as you can log in.