Site key and install check
What the public site key in your install code is, why it is safe to publish, and how the install check decides that the code is on your site.
Each website in Tafsee Popup has a public site key that starts with pk_. It is part of the install code:
<script>
(function (w, d, s, id) {
if (d.getElementById(id)) return;
var js = d.createElement(s); js.id = id; js.async = true;
js.src = 'https://popup.beta.tafsee.com/embed/v1.js';
js.dataset.site = 'pk_your_site_key';
d.head.appendChild(js);
})(window, document, 'script', 'tafsee-popup');
</script>What the key does
The key tells Tafsee which website's published campaigns to load. That is all it can do. It cannot read leads, change campaigns or reach your account, so it is safe in your page source.
One key per website
Do not put the key of one website on another. The app then says: This site has a different Tafsee install code, probably from another workspace. Replace it with this site's code, then check again.
How the install check decides
- When a page with the code is opened, the script reports in to Tafsee. A report counts only when it comes from the website's own domain, because the key is public and any page could carry it.
- If a report arrived in the last seven days, the check passes.
- If not, Tafsee fetches your homepage and looks for your site key in its HTML.
- The result is one of three: found, not found yet (the site answered but the key is not in the homepage), or the site could not be reached.
This is why a code added through a tag manager, or only on inner pages, passes the check after you open such a page once in a browser.
Where a campaign runs
A campaign belongs to one website and runs through that website's key. Pausing, publishing or deleting campaigns needs no change in your code.
Test panel
Add ?tafsee-debug=1 to a page address. A panel lists every campaign of the website and the reason each one is or is not showing. If the page's host is not the domain the website was added with, the panel says so.
