Tracker install and config
The script tag, collect, goals, and the fields a pageview stores.
Last updated on
The readable source is tracker/databob.js. The site serves the minified file at https://databob.dev/databob.js. It is about 12 KB. It does not load a framework. Banner CSS is inside that file and is created only when a visitor is prompted.
The tracker looks for a script element that has both data-site and data-key. If either is missing, or if data-config is missing, it does nothing.
Attributes
| Attribute | Required | Default |
|---|---|---|
src | yes | https://databob.dev/databob.js |
data-site | yes | Project id. The dashboard fills this in. |
data-key | yes | Write key. dbw_ prefix. Shown once. |
data-collect | no | https://us-ingest.databob.dev/v1/collect |
data-config | yes | https://savory-yak-367.convex.site/v1/consent/<siteId> |
data-choices | no | https://databob.dev, the host of /c/<siteId> |
data-config is the public consent document for that site. A dev deployment uses https://adventurous-scorpion-919.convex.site/v1/consent/<siteId> when that base URL is configured. The published script does not read any other data-* attribute. There is no attribute for a custom content id.
<script async src="https://databob.dev/databob.js" data-site="YOUR_SITE_ID" data-key="YOUR_WRITE_KEY" data-collect="https://us-ingest.databob.dev/v1/collect" data-config="https://savory-yak-367.convex.site/v1/consent/YOUR_SITE_ID" data-choices="https://databob.dev"></script>EU ingest is not published
Collect is us-ingest.databob.dev only. There is no EU ingest hostname in this release.
What the browser sends
A pageview is POST /v1/collect with the write key in the JSON body. The body is sent with navigator.sendBeacon when that is available, otherwise fetch with keepalive. The tracker sends:
{
"write_key": "dbw_…",
"type": "pageview",
"path": "/pricing",
"consent": { "analytics": "denied", "source": "databob" }
}path is the pathname. The query string and fragment are not part of the stored path. consent.analytics is granted only when enhanced analytics is on, the visitor accepted the current consent version, and the browser is not opted out. When it is granted, the body also includes consent.version, the document referrer, and utm_source, utm_medium, and utm_campaign when those query parameters are present.
The published script does not set content_id. The Worker then stores the pathname as the content id. A direct POST may include content_id. The query string and fragment are removed from that value. An empty value falls back to the pathname.
Collect responses
The request origin has to be one of the project's allowed origins. A missing Origin header is refused.
| Result | Status | Body |
|---|---|---|
| Anonymous pageview stored | 202 | { "stored": true } |
| Pageview stored with the richer consent tier | 202 | { "stored": true } |
| Consent choice stored | 202 | { "stored": true } |
| Goal event without the richer consent tier | 200 | { "stored": false, "reason": "consent" } |
| Goal name is not the project's goal | 200 | { "stored": false, "reason": "event" } |
| Write key missing | 400 | { "stored": false, "reason": "missing_write_key" } |
| Write key unknown | 401 | { "stored": false, "reason": "unknown_write_key" } |
| Origin not allowed | 403 | { "stored": false, "reason": "origin" } |
Sec-GPC: 1 and DNT: 1 force the anonymous tier even when the visitor granted analytics and the version matches. consent.source is accepted and ignored for that decision.
Goals
databob.track(name) sends a goal event. The optional second argument is a finite number. It defaults to 1.
databob.track("signup");
databob.track("signup", 1);The event is stored only when all of these are true:
- Enhanced analytics is on for the project.
- The visitor granted the current consent version, and the browser is not sending Global Privacy Control or Do Not Track.
namematches the goal event name saved on the project. Any other name returns200withreason: "event"and stores nothing.
The call does nothing if the tracker has not finished loading config, or if the richer tier is not active. It does not throw.
Region lookup
When the banner is limited to the EU, the EEA, the UK, Switzerland, and Canada, the script calls GET /v1/region on the collect host. That route returns { "country": "DE" } and writes nothing. An unknown country is asked. Visitors outside that list are not asked.
Config cache
The public consent document and the write-key lookup are cached for 60 seconds. A consent edit can take about a minute to apply on new pageviews.