Sequenzy Web Tracking Keys API
Publishable keys for the browser tracking SDK that sends on-site events from any website
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/sequenzy:sequenzy-web-tracking-keys-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Sequenzy Web Tracking Keys API
description: Sequenzy API for managing subscribers, tags, events, sequences, and transactional emails
version: 1.0.0
servers:
- url: https://api.sequenzy.com/api/v1
description: Production server
- url: https://api.sequenzy.com/v1
description: Legacy production server alias
security:
- bearerAuth: []
tags:
- name: Web Tracking Keys
description: Publishable keys for the browser tracking SDK that sends on-site events from any website
paths:
/web-tracking-identities:
post:
operationId: mintWebTrackingIdentity
summary: Mint a web tracking identity token
description: Mints a short-lived HMAC proof bound to one active web tracking key, workspace, and normalized email. Identify the key by keyId or by its publishable publicKey value. If the email is not yet a contact, one is created (active, no lists, no automations triggered) so identified events are attributed instead of being silently dropped. Call this only from an authenticated backend; never expose the secret API key in browser code. Identified browser events without this proof are rejected before queueing. Requires commerce:write, automations:trigger, and subscribers:write (minting can create the contact).
tags:
- Web Tracking Keys
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- email
properties:
keyId:
type: string
description: Internal web tracking key ID. Provide this or publicKey.
publicKey:
type: string
description: Publishable key value (seq_pk_...). Provide this or keyId.
email:
type: string
format: email
ttlHours:
type: number
minimum: 0.016666666666666666
maximum: 720
default: 24
responses:
'200':
description: Identity proof minted
content:
application/json:
schema:
type: object
properties:
success:
type: boolean
keyId:
type: string
publicKey:
type: string
email:
type: string
format: email
subscriberId:
type: string
description: Contact the minted identity resolves to; created on first mint for a new email.
identityToken:
type: string
expiresAt:
type: string
format: date-time
'400':
description: Invalid email or token lifetime, neither keyId nor publicKey provided, or the email cannot be added as a contact
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'403':
description: API key is missing commerce:write, automations:trigger, or subscribers:write
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'404':
description: Active web tracking key not found
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
/web-tracking-keys:
get:
operationId: listWebTrackingKeys
summary: List web tracking keys
description: Lists the publishable keys that let a website send on-site events (product views, cart activity, collection views, search) into this workspace. Each key includes a paste-ready install snippet and its origin allowlist. A key whose lastUsedAt is null has not successfully authenticated an event yet; it may be undeployed, have no instrumented traffic, or be sending requests rejected by its origin allowlist. Shopify stores use the storefront pixel instead. Requires the integrations:manage scope.
tags:
- Web Tracking Keys
responses:
'200':
description: Web tracking keys
content:
application/json:
schema:
type: object
properties:
success:
type: boolean
keys:
type: array
items:
$ref: '#/components/schemas/WebTrackingKey'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'403':
description: API key is missing the integrations:manage scope
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
post:
operationId: createWebTrackingKey
summary: Create a web tracking key
description: Creates a publishable key for the browser tracking SDK and returns the script tag to install. The key ships in page source by design and authorizes storefront events only, never the rest of the API. Events start flowing once the snippet is deployed and nothing is backfilled for the period before that. Always pass allowedOrigins for a website or allowedAppIds for an iOS or Android app - a key with neither accepts events from any site or app. Requires the integrations:manage scope.
tags:
- Web Tracking Keys
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- name
properties:
name:
type: string
maxLength: 255
description: Human-readable label, e.g. Storefront.
allowedOrigins:
type: array
maxItems: 50
items:
type: string
description: Origins allowed to use this key. A bare domain is read as https. A leading *. matches subdomains at any depth but not the apex. Omitting this and allowedAppIds leaves the key unrestricted.
allowedAppIds:
type: array
maxItems: 20
items:
type: string
description: iOS bundle IDs and Android package names allowed to use this key from the mobile SDKs, e.g. com.example.app. Duplicates are dropped case-insensitively.
responses:
'200':
description: Key created
content:
application/json:
schema:
type: object
properties:
success:
type: boolean
key:
$ref: '#/components/schemas/WebTrackingKey'
message:
type: string
'400':
description: Invalid name, or an allowedOrigins or allowedAppIds entry that is not valid. The whole request is rejected rather than saving the valid subset.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'403':
description: API key is missing the integrations:manage scope
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
/web-tracking-keys/{id}:
get:
operationId: getWebTrackingKey
summary: Get a web tracking key
description: Returns one web tracking key with its install snippet and ingest endpoint. The snippet embeds both the publishable key and the workspace id, so use it as returned rather than rebuilding it. Requires the integrations:manage scope.
tags:
- Web Tracking Keys
parameters:
- name: id
in: path
required: true
description: Web tracking key ID.
schema:
type: string
responses:
'200':
description: Web tracking key
content:
application/json:
schema:
type: object
properties:
success:
type: boolean
key:
$ref: '#/components/schemas/WebTrackingKey'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'403':
description: API key is missing the integrations:manage scope
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'404':
description: Web tracking key not found
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
patch:
operationId: updateWebTrackingKey
summary: Update a web tracking key
description: Renames a key, replaces its allowed origins or app IDs, or revokes it. allowedOrigins and allowedAppIds each replace the whole list rather than appending. Revoking stops events within about a minute while preserving the key value, so the matching snippet can still be found and removed from the site. Requires the integrations:manage scope.
tags:
- Web Tracking Keys
parameters:
- name: id
in: path
required: true
description: Web tracking key ID.
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
type: object
minProperties: 1
properties:
name:
type: string
maxLength: 255
allowedOrigins:
type: array
maxItems: 50
items:
type: string
description: Replacement origin allowlist. The key becomes unrestricted when both this and allowedAppIds are empty.
allowedAppIds:
type: array
maxItems: 20
items:
type: string
description: Replacement list of iOS bundle IDs and Android package names.
isActive:
type: boolean
description: Set false to revoke the key, true to re-enable a revoked one.
responses:
'200':
description: Key updated
content:
application/json:
schema:
type: object
properties:
success:
type: boolean
key:
$ref: '#/components/schemas/WebTrackingKey'
'400':
description: An allowedOrigins or allowedAppIds entry is not valid, or no field was provided
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'403':
description: API key is missing the integrations:manage scope
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'404':
description: Web tracking key not found
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
delete:
operationId: deleteWebTrackingKey
summary: Delete a web tracking key
description: Permanently deletes a web tracking key. Cached authorization expires within one minute, after which requests from a remaining snippet are rejected. Remove the snippet as well. Prefer revoking with isActive false when the key may be needed again. Requires the integrations:manage scope.
tags:
- Web Tracking Keys
parameters:
- name: id
in: path
required: true
description: Web tracking key ID.
schema:
type: string
responses:
'200':
description: Key deleted
content:
application/json:
schema:
type: object
properties:
success:
type: boolean
message:
type: string
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'403':
description: API key is missing the integrations:manage scope
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'404':
description: Web tracking key not found
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
components:
schemas:
InputIssue:
type: object
properties:
path:
type: string
description: Dotted field path, such as `audience.subscriberIds[0]`. Empty when the problem is with the request body itself.
example: kind
message:
type: string
description: What is wrong with the field.
example: must be "add_tags"
allowedValues:
type: array
description: Accepted values when the field only takes a fixed set of values.
items: {}
example:
- add_tags
required:
- path
- message
WebTrackingKey:
type: object
description: A publishable key for the browser tracking SDK and the mobile SDKs. The key ships in the customer's page source or app by design, so it is not a secret; it authorizes client events only and carries origin and app ID allowlists instead of scopes.
properties:
id:
type: string
name:
type: string
publicKey:
type: string
description: The publishable key, prefixed seq_pk_.
allowedOrigins:
type: array
items:
type: string
description: Normalized origins allowed to use this key from a browser.
allowedAppIds:
type: array
items:
type: string
description: iOS bundle IDs and Android package names allowed to use this key from the mobile SDKs, matched case-insensitively against the x-sequenzy-app-id header on requests without an Origin header. A key with app IDs and no origins is rejected from browsers.
isActive:
type: boolean
description: False when revoked. Revoked keys are rejected at ingest.
unrestricted:
type: boolean
description: True when both allowedOrigins and allowedAppIds are empty, so any site or app can send events with this key.
lastUsedAt:
type:
- string
- 'null'
format: date-time
description: When the key last authorized an event, or null if it never has. Updated at most every five minutes.
createdAt:
type: string
format: date-time
updatedAt:
type: string
format: date-time
installSnippet:
type: string
description: The exact script tag to paste into every page. Embeds both the key and the workspace id.
endpoint:
type: string
description: Ingest URL the SDK posts events to.
warning:
type: string
description: Present only when the key is unrestricted.
Error:
type: object
properties:
success:
type: boolean
example: false
error:
type: string
example: Error message
code:
type: string
description: Optional stable machine-readable error discriminator when available.
example: COMPANY_CREATE_REQUIRES_PERSONAL_KEY
retryable:
type: boolean
description: Whether retrying the request can recover from the error.
issues:
type: array
description: Field-level problems with the request, when the endpoint reports them. Up to ten entries; `error` summarizes the first three.
items:
$ref: '#/components/schemas/InputIssue'
required:
- error
securitySchemes:
bearerAuth:
type: http
scheme: bearer
description: API key passed as Bearer token