# Installing TracerKit TracerKit manages your tracking scripts (analytics, pixels) outside your codebase and verifies every tag actually fires. Install is one script tag; everything else happens in the dashboard. ## Enhanced matching & dedup (loader API) Two optional calls raise your CAPI match quality and prevent double-counting: ```js // hash email/phone IN the browser (SHA-256) — raw values never leave the page. // Meta's single highest-impact match parameter. tracerkit.identify({ email: user.email, phone: user.phone }); // if you also run a browser pixel, pass the shared event id so the // platform dedupes pixel + server into ONE conversion: fbq("track", "Purchase", { value, currency }, { eventID: tracerkit.lastEventId }); ``` Click ids (gclid / fbclid / ttclid), _fbp/_fbc, _ttp, and GA4 client/session ids are captured automatically and forwarded server-side. ## Consent Mode v2 TracerKit understands the four Google Consent Mode v2 signals (`ad_storage`, `analytics_storage`, `ad_user_data`, `ad_personalization`). Wire your CMP's callback to `tracerkit.consent` — it accepts GCMv2 signal names (`"granted"`/`"denied"` or booleans) or TracerKit categories (`analytics` ⇔ `analytics_storage`, `marketing` ⇔ `ad_storage` + the ad_user_data/ad_personalization bundle): ```js // from your CMP's onConsent callback — GCMv2 names pass straight through: tracerkit.consent({ ad_storage: "granted", analytics_storage: "granted", ad_user_data: "granted", ad_personalization: "denied", }); // or the shorthand categories: tracerkit.consent({ analytics: true, marketing: false }); ``` If your CMP already drives Google tags via `gtag('consent', 'default'|'update', {...})`, TracerKit picks that up from `window.dataLayer` automatically (best-effort — if gtag.js loads after the CMP AND after TracerKit, call `tracerkit.consent` explicitly). What consent controls: - **Client**: tags in the `analytics`/`marketing` consent category stay blocked until the matching signal (`analytics_storage`/`ad_storage`) is granted; blocked fires replay once consent arrives. - **Server**: each event carries the consent state at fire time. Server-side forwarding to ad platforms (Meta, TikTok, Google Ads) requires `ad_storage` + `ad_user_data`; GA4 requires `analytics_storage`. Google Ads uploads include the GCMv2 consent fields the Data Manager API expects. - Sites that never signal consent are unaffected — enforcement only applies when consent state is sent. ## Hand it to an AI agent Copy the ready-made prompt from your site's dashboard page ("Copy prompt for your AI agent") into Claude Code, Cursor, or any coding agent — it contains your real key, the dedupe rules, and the verification steps. ## MCP server (dashboard access for agents) Coding agents can also do the dashboard side — create the site, move tags in, and verify beacons — over MCP (streamable HTTP): - **Endpoint**: `https://tracerkit.com/api/mcp` - **Auth**: `Authorization: Bearer tkapi_...` — an org owner/admin creates tokens under Settings → API tokens (https://tracerkit.com/dashboard/settings). The token is shown once; it scopes every call to that organization. - **Tools**: `list_sites`, `create_site`, `list_tags`, `create_tag`, `get_site_health`, `get_install_snippet` Example `.mcp.json` entry: ```json { "mcpServers": { "tracerkit": { "type": "http", "url": "https://tracerkit.com/api/mcp", "headers": { "Authorization": "Bearer tkapi_YOUR_TOKEN" } } } } ``` ## 1. Get your site key Sign in at https://tracerkit.com/dashboard, add your site, and copy its public key (looks like `tk_...`) from the site page — the exact snippet is shown there. ## 2. Add the snippet Paste into your site-wide ``, ideally before other third-party scripts: ```html ``` The loader is ~2KB gzipped and `async` — it never blocks rendering. ### Framework placement - **Plain HTML / WordPress / Shopify / Webflow**: the shared head template (WordPress: a header-scripts plugin or your theme's `header.php`). - **Next.js (App Router)**: a plain `