One script gives every page view, source, custom event and Web Vital, next to the content that brought the visitor. It is about 1 KB gzipped, sets no cookies and Manifolio stores no IP addresses.
Add the script
Create a publishable key in Developers → API keys and list the domains it may send from, for example aurora.coffee and *.aurora.coffee. Then add one line to every page:
<script defer src="https://api.manifolio.com/t.js" data-key="mf_pk_live_your_site_key"></script>A publishable key can only send analytics and form submissions, and only from its domains, so it is safe in the page source. Development keys (mf_pk_test_) also accept localhost.
The script records:
- a page view on load and on every client-side navigation (
pushState,replaceState,popstate) - Web Vitals (LCP, INP, CLS, FCP, TTFB), once per page, when the page is hidden
- custom events you send with
track()
It sends nothing when the browser has Do Not Track or Global Privacy Control turned on, or when it runs under automation.
Custom events
manifolio.track("order_click", { bean: "ethiopia-guji", size: 250 });- the name has up to 64 letters, digits, spaces or
_ . : / - - up to 10 properties; keys up to 40 characters; values are strings (up to 200 characters), numbers or booleans
Calls made before the script loads are not lost. Queue them and the script sends them when it starts:
<script>
window.manifolio = window.manifolio || { q: [] };
window.manifolio.track = window.manifolio.track || function () { window.manifolio.q.push(arguments); };
</script>Events show up under Analytics → Events and on the dashboard.
What is stored
| Data | How |
|---|---|
| Visitor | the first 8 bytes of SHA-256 of a daily salt, the IP address, the user agent and the project. The salt is deleted when the day ends, so a visitor cannot be followed from one day to the next |
| Country | from the edge network's country header; the IP address itself is never written |
| Device and browser | from the window width and a small user agent parser |
| Source | utm_source, otherwise the referring site, otherwise direct |
| Pages | the path only (/shop/espresso); query strings and fragments are dropped |
Raw events are kept 90 days; daily totals are kept two years.
Limits
A batch is at most 16 KB and 25 events. Each visitor can send 60 events a minute and each project 6,000; above that the API answers 429 with Retry-After. Bots are dropped by user agent.
Your own endpoint
If you serve the script yourself or proxy the API, data-api changes where events go:
<script defer src="/t.js" data-key="mf_pk_live_your_site_key" data-api="https://api.manifolio.com"></script>