Tracker — Install

1. Verify your domain

In the Pathbound dashboard, go to Settings → Domains and add the hostname your site runs on (e.g. example.com). Verification confirms the tenant owns the domain so the tracker server will accept events from it.

The tracker rejects events from domains that aren’t verified — this is what protects your tenant from someone else dropping your snippet on their site.

2. Add the snippet

Place this just before the closing </body> tag on every page you want to track:

<script async src="https://tracker.pathbound.ai/tracker.js"></script>

That’s it. No configuration, no API keys, no callbacks to wait for.

The script:

• Runs on DOMContentLoaded (or immediately, if the DOM is already ready).
• Reads/sets the pathbound_visitor_id and pathbound_session_id cookies.
• Fires page_view on load, then attaches click and submit listeners for the rest of the session.
• Batches events (up to 10 per batch or 2 seconds) and POSTs to tracker.pathbound.ai/track.

3. Verify events are flowing

Open your site, click around, then in another tab make this REST call:

curl "https://api.pathbound.ai/v1/events?limit=5&sort_dir=desc" \
  -H "Authorization: Bearer YOUR_API_KEY"

You should see page_view, button_click, etc. with the correct domain and url.

If nothing appears within a few seconds:

• Check the browser console — the snippet logs to console.warn on batch failures.
• Confirm the domain is verified in the dashboard.
• Confirm the user has not set pathbound_dnt=1 (the do-not-track opt-out cookie).

SPA routing (React/Vue/Svelte/Next/etc.)

The tracker fires page_view once on script load. For client-side route changes, fire it manually:

// After every route change in your SPA
window.pathbound?.track('page_view', {
  title: document.title,
  path: location.pathname,
});

See Custom events for the full track() API.

Self-hosted tracker

If you’d rather host the tracker on your own subdomain (e.g. tracker.yourcompany.com), run the @pathbound/tracker service on your infrastructure and set TRACKER_PUBLIC_HOST=tracker.yourcompany.com. The snippet URL just becomes https://tracker.yourcompany.com/tracker.js. Events still write to the shared backend MongoDB, so they show up in your tenant exactly the same way.

This is useful for cookie-domain alignment (first-party context for pathbound_visitor_id) or when corporate networks block pathbound.ai.

Tag managers

If you load the snippet via Google Tag Manager or similar, don’t place it inside an iframe — the cookie scope and Referer validation depend on running in the page’s main document context.

Disabling tracking for a specific user

Set the pathbound_dnt cookie to 1 on your domain. The tracker checks this cookie at the very top of the script and exits immediately if it’s present. This is the recommended way to honor a user-level “do not track” preference.

document.cookie = 'pathbound_dnt=1; path=/; max-age=31536000; SameSite=Strict; Secure';