Website tracking

Every option is an attribute on the same script tag. Only data-site is required.

• data-site: your public site key. Required.
• data-api: override the collector origin. Set this when you serve first-party.
• data-link-domains: comma-separated sibling hosts. Outbound links to these are decorated so one visitor stays one visitor across your domains.
• data-consent="denied": start opt-in. Nothing is collected until you call roas.consent(true).
• data-debug: print the SDK's own swallowed errors to the console. ?roasdebug=1 on any URL does the same without a redeploy.

<script
  async
  src="https://cdn.roassensor.com/roas.js"
  data-site="YOUR_PUBLIC_KEY"
  data-api="https://yourdomain.com/_rs"
  data-link-domains="checkout.yourdomain.com,app.yourdomain.com"
  data-consent="denied"
></script>

Once loaded, the SDK exposes window.roas. This is all of it:

// Track a pageview by hand (SPA route changes are automatic)
roas.page();

// Attach a known identity to this visitor
roas.identify("[email protected]", "+15551234567");

// Funnel and behaviour events
roas.track("signup", { plan: "growth" });

// Consent, for a cookie banner's Accept / Reject
roas.consent(true);

// Read-only
roas.vid;      // visitor id
roas.session;  // current session id
roas.version;  // "0.5.0"

Single-page apps need no extra work. The SDK wraps history.pushState and replaceState and listens for popstate and hashchange. Call roas.page() only for view changes that never touch the URL, like a modal you want counted as a step.

Calling before the script loads is safe. Queue with either shape and the SDK replays it in arrival order once it boots:

window.roas = window.roas || [];
window.roas.push(["track", "signup", { plan: "growth" }]);

roas.identify(email, phone) turns an anonymous browser into a person you can match across devices. Both arguments are optional; pass whichever you have.

Raw email and phone never leave the browser on an HTTPS page. The SDK normalises and SHA-256 hashes them first and sends only the hash. That normalisation is mirrored byte-for-byte on the server, so a hash minted in the browser matches one minted from your database.

You often need not call it at all: the SDK already captures identity from form submits and from completed email or phone fields on blur. Call it explicitly for JS-only flows that never submit a real form.