Domains, site keys and the install card
A domain is a website origin that you register in Backoffice. Each domain gets a site key that the collector script uses to send results for that origin. A workspace Admin registers the domain here, copies the key and then installs the script from Script & Consent.
What it is
Availability: Availability depends on your plan, role and the modules enabled for your organisation.
- Domains list (
Backoffice → Administration → Domains): one row per registered origin with its tenant (platform operators only), origin, masked site key, status, tracker switch, retention, last seen time and actions. - Site key: a public identifier. It is safe to put in page source because it is bound to the registered origin: the collector accepts submissions from that origin only. Keep one domain, and one key, per environment. A site key is not a secret API key; server keys live under Integrations and API pages.
- Install Noxtica card: a card under the list. It links to Integrations & API → Script & Consent → Snippets, the single place that holds install snippets, consent modes and checks. The card does not duplicate them.
- Domain detail (
/domains/<id>): the full record for one origin, with the tabs Configuration, Risk rules, Integration, Relay and Recent events.
The full install walkthrough is in Install & Browser Runtime. Consent behaviour is in Consent modes, GPC and Google Consent Mode.
Prerequisites
- The Admin role in the workspace. Viewers and Analysts do not see the Domains page in the sidebar. See Backoffice guide.
- An authenticator app. Creating, changing, rotating and deleting a domain each ask for a fresh MFA check.
- The exact origin to register: scheme, host and optional port, with no path, query or fragment. Use
https. Plainhttpis accepted forlocalhostand127.0.0.1development only. - Room in your plan’s domain limit. Your plan sets the maximum number of domains.
- Some per-domain controls (proof-of-work attestation, GPU VM rollout, cookie content capture, the Client RUM sample rate) are changed by Noxtica operators on request. They appear read-only to a workspace Admin.
Steps
1. Add a domain
- Open
Backoffice → Administration → Domains. - Select Add domain.
- Enter the Origin URL, for example
https://www.example.com. Do not include a path, query string or hash. - Select Create domain and enter your MFA code when asked.
The console checks the format before it sends the request, and the server checks it again:
| Rule | Message |
|---|---|
| Must parse as a URL | Invalid URL format. Expected: https://example.com |
| No path, query or hash | Origin should not include path, query, or hash (e.g., https://example.com) |
https only, except localhost | HTTP origins are only allowed for localhost development |
| Each origin once | Origin already registered |
| Plan limit | Maximum domains limit reached for this tenant |
On success a toast reads: “Domain "" created in API consent mode: the page check stays off until your site calls setConsent().” The new row has the status Active.
2. Copy the site key
In the Site key column the key is masked. Select Reveal site key to show it, then Copy. The domain detail header has the same Site key copy button. Use a separate domain, with its own key, for staging and production.
3. Install the script
Select Install Noxtica → Script & Consent on the Domains page, or open the domain and use the Integration tab. Both open Integrations & API → Script & Consent on the Snippets tab. The domain tab link preselects the domain (?tab=snippets&domain_id=<id>). Copy the core script and add it to every page. The walkthrough is Install & Browser Runtime.
4. Know the consent default for new domains
A domain that you create now starts in API consent mode. Until your site calls noxticaClient.setConsent() (or noxtica('setConsent', …)) with the deviceId category granted:
- the page check is skipped, and
noxtica:collectedcarriesskipped: 'consent_required'; - nothing persistent is written on the visitor’s device;
- only protected actions run.
Domains that existed before this default keep the mode they have. To change a domain’s mode, including Not required, open the domain and use Configuration → Client consent mode (options Not required, API, Cookie), or use Script & Consent → Consent & extensions. A cookie mode takes a cookie name (1 to 64 letters, digits, underscores, dots or hyphens) and an optional value (up to 128 characters from letters, digits and _ . : % + -). See Consent modes, GPC and Google Consent Mode.
5. Review and change per-domain settings
Open a domain from the list. The Configuration tab is a stack of cards:
| Card | What you can change | Bounds and notes |
|---|---|---|
| Canonical origin | Nothing; copy the origin | Submissions are accepted from this origin only. Several origins per domain are not available |
| Lifecycle | Status (enable or disable), Tracker collection | Disabling stops new submissions; existing data stays. With the tracker off the script is served but does not POST submissions |
| Retention | Retention (days), Check interval (days), Token refresh interval | Retention override 1 to 365 days; empty inherits the tenant value. Check interval 1 to 30 days. Token refresh 30 seconds to 24 hours, never below your plan floor. Effective shows the value the script receives |
| Client log level | Console verbosity of the script’s own diagnostics: Silent, Error, Warn, Info, Debug, or SDK default | A data-log-level attribute or an init option always overrides it |
| Client consent mode | Not required, API, Cookie | See step 4 |
| Tracker policy | VM telemetry, Debug signals, Browser interactions, Heatmaps, User journeys, App events, Sample rate | Sample rate 0.0 to 1.0. Heatmaps and User journeys need Browser interactions and default to off |
| Hardware Attestation | PoW attestation, GPU VM, rollout percentage | Operator-controlled. Runs real work in the visitor’s browser |
| Cookie capture | Cookie content capture | Operator-controlled. Off by default; needs a documented lawful basis |
| Client RUM | Sample rate | Operator-controlled |
The other tabs:
- Risk rules: rules added here apply to this origin only. Tenant-wide rules from
Detection & Collection → Rules & Risk Scoringapply alongside them. See Detection and collection settings. - Integration: a link to Script & Consent for this domain.
- Relay: a read-only list of first-party relay hostnames for this domain, with the CNAME target and TXT record to publish. Provision hostnames in
Integrations & API → Relay Hostnames. See Content Security Policy, hosts and first-party relay. - Recent events: audit entries for this domain, such as updates and rotations. See Audit log and data export.
The header of the detail page shows four counters: Submissions (30d), Blocked, Challenged and Pass-through rate. A Verdict funnel (last 30 days) card shows how submissions narrow from intake to decisions. Counts under the anonymity threshold are hidden, and a hidden stage is not a zero.
6. Disable, rotate or delete
- Disable: on the list use the power icon; on the detail page use Lifecycle → Status. A disabled domain shows Revoked on the list and Disabled on the detail page. Enable resumes collection with the same site key.
- Rotate: Rotate key on the detail page, or the rotate icon on the list. The current key stops working immediately, so update every snippet that uses it before you rotate. The change needs MFA.
- Delete: the trash icon on the list, or Delete on the detail page. Type the host name to confirm. Deletion removes the domain, its site key and the data associated with it. It cannot be undone.
7. Export the list
Select Export CSV above the table to download the domains you can see.
Verify it works
- The domain row is Active, and its masked site key matches the key in your snippet.
- After the script runs on your site, the Last seen column shows a time.
Script & Consent → Check it workswalks through the same check on the page side. - In API consent mode, open your site and confirm that your consent banner calls
setConsent(). Until it does, the page check is skipped by design. - On the domain detail page, Submissions (30d) counts rise once traffic is collected.
- After you change a setting or rotate the key,
Recent eventslists that update or rotation.
Troubleshooting
| Symptom | Cause | Fix |
|---|---|---|
| Add domain is missing | The Domains page needs the Admin role | Ask a workspace Admin |
Origin should not include path, query, or hash | You entered a full page URL | Enter just https://host |
HTTP origins are only allowed for localhost development | You used http for a real host | Register the https origin |
Origin already registered | The origin exists in the workspace, or the same origin is registered elsewhere | Use the existing domain, or ask your account team |
Maximum domains limit reached for this tenant | Your plan’s domain limit | Delete an unused domain or ask your account team |
| The script loads but no page check appears | A new domain starts in API consent mode | Call setConsent() after consent, or change the mode under Client consent mode |
| Collection stopped after a rotation | Snippets still carry the old key | Copy the new key into every snippet |
| No submissions, tracker off | Tracker collection is off for the domain | Turn it on under Lifecycle |
| The PoW attestation, cookie capture or Client RUM controls are greyed out | These controls are operator-only | Ask your account team |
| A change asks for a code again | A sensitive change needs a fresh MFA check | Enter the authenticator code |
Related
- Backoffice guide: navigation, roles and shortcuts: roles, palette and shortcuts.
- Install & Browser Runtime: the install walkthrough.
- Script attributes and client options: script tag attributes such as
data-log-level. - Consent modes, GPC and Google Consent Mode: consent modes and the API.
- Protected actions: client trigger and server check: what still runs without consent.
- Detection and collection settings: tenant-wide rules, cost levels and probes.
- Roles and permissions: who can manage domains.