Domains, site keys and the install card

A domain is a website origin that you register in Backoffice. Each domain gets a site key that the collector script uses to send results for that origin. A workspace Admin registers the domain here, copies the key and then installs the script from Script & Consent.

What it is

Availability: Availability depends on your plan, role and the modules enabled for your organisation.

• Domains list (Backoffice → Administration → Domains): one row per registered origin with its tenant (platform operators only), origin, masked site key, status, tracker switch, retention, last seen time and actions.
• Site key: a public identifier. It is safe to put in page source because it is bound to the registered origin: the collector accepts submissions from that origin only. Keep one domain, and one key, per environment. A site key is not a secret API key; server keys live under Integrations and API pages.
• Install Noxtica card: a card under the list. It links to Integrations & API → Script & Consent → Snippets, the single place that holds install snippets, consent modes and checks. The card does not duplicate them.
• Domain detail (/domains/<id>): the full record for one origin, with the tabs Configuration, Risk rules, Integration, Relay and Recent events.

The full install walkthrough is in Install & Browser Runtime. Consent behaviour is in Consent modes, GPC and Google Consent Mode.

Prerequisites

• The Admin role in the workspace. Viewers and Analysts do not see the Domains page in the sidebar. See Backoffice guide.
• An authenticator app. Creating, changing, rotating and deleting a domain each ask for a fresh MFA check.
• The exact origin to register: scheme, host and optional port, with no path, query or fragment. Use https. Plain http is accepted for localhost and 127.0.0.1 development only.
• Room in your plan’s domain limit. Your plan sets the maximum number of domains.
• Some per-domain controls (proof-of-work attestation, GPU VM rollout, cookie content capture, the Client RUM sample rate) are changed by Noxtica operators on request. They appear read-only to a workspace Admin.

Steps

1. Add a domain

1. Open Backoffice → Administration → Domains.
2. Select Add domain.
3. Enter the Origin URL, for example https://www.example.com. Do not include a path, query string or hash.
4. Select Create domain and enter your MFA code when asked.

The console checks the format before it sends the request, and the server checks it again:

On success a toast reads: “Domain "" created in API consent mode: the page check stays off until your site calls setConsent().” The new row has the status Active.

2. Copy the site key

In the Site key column the key is masked. Select Reveal site key to show it, then Copy. The domain detail header has the same Site key copy button. Use a separate domain, with its own key, for staging and production.

3. Install the script

Select Install Noxtica → Script & Consent on the Domains page, or open the domain and use the Integration tab. Both open Integrations & API → Script & Consent on the Snippets tab. The domain tab link preselects the domain (?tab=snippets&domain_id=<id>). Copy the core script and add it to every page. The walkthrough is Install & Browser Runtime.

4. Know the consent default for new domains

A domain that you create now starts in API consent mode. Until your site calls noxticaClient.setConsent() (or noxtica('setConsent', …)) with the deviceId category granted:

• the page check is skipped, and noxtica:collected carries skipped: 'consent_required';
• nothing persistent is written on the visitor’s device;
• only protected actions run.

Domains that existed before this default keep the mode they have. To change a domain’s mode, including Not required, open the domain and use Configuration → Client consent mode (options Not required, API, Cookie), or use Script & Consent → Consent & extensions. A cookie mode takes a cookie name (1 to 64 letters, digits, underscores, dots or hyphens) and an optional value (up to 128 characters from letters, digits and _ . : % + -). See Consent modes, GPC and Google Consent Mode.

5. Review and change per-domain settings

Open a domain from the list. The Configuration tab is a stack of cards:

The other tabs:

• Risk rules: rules added here apply to this origin only. Tenant-wide rules from Detection & Collection → Rules & Risk Scoring apply alongside them. See Detection and collection settings.
• Integration: a link to Script & Consent for this domain.
• Relay: a read-only list of first-party relay hostnames for this domain, with the CNAME target and TXT record to publish. Provision hostnames in Integrations & API → Relay Hostnames. See Content Security Policy, hosts and first-party relay.
• Recent events: audit entries for this domain, such as updates and rotations. See Audit log and data export.

The header of the detail page shows four counters: Submissions (30d), Blocked, Challenged and Pass-through rate. A Verdict funnel (last 30 days) card shows how submissions narrow from intake to decisions. Counts under the anonymity threshold are hidden, and a hidden stage is not a zero.

6. Disable, rotate or delete

• Disable: on the list use the power icon; on the detail page use Lifecycle → Status. A disabled domain shows Revoked on the list and Disabled on the detail page. Enable resumes collection with the same site key.
• Rotate: Rotate key on the detail page, or the rotate icon on the list. The current key stops working immediately, so update every snippet that uses it before you rotate. The change needs MFA.
• Delete: the trash icon on the list, or Delete on the detail page. Type the host name to confirm. Deletion removes the domain, its site key and the data associated with it. It cannot be undone.

7. Export the list

Select Export CSV above the table to download the domains you can see.

Verify it works

• The domain row is Active, and its masked site key matches the key in your snippet.
• After the script runs on your site, the Last seen column shows a time. Script & Consent → Check it works walks through the same check on the page side.
• In API consent mode, open your site and confirm that your consent banner calls setConsent(). Until it does, the page check is skipped by design.
• On the domain detail page, Submissions (30d) counts rise once traffic is collected.
• After you change a setting or rotate the key, Recent events lists that update or rotation.

Troubleshooting

Related

• Backoffice guide: navigation, roles and shortcuts: roles, palette and shortcuts.
• Install & Browser Runtime: the install walkthrough.
• Script attributes and client options: script tag attributes such as data-log-level.
• Consent modes, GPC and Google Consent Mode: consent modes and the API.
• Protected actions: client trigger and server check: what still runs without consent.
• Detection and collection settings: tenant-wide rules, cost levels and probes.
• Roles and permissions: who can manage domains.