Security & data
Keep analytics useful without putting credentials at risk
Clarvivo separates public browser tracking from private account and payment authorization. The distinction matters: a key that is safe to put in a script tag is not safe for an API or payment operation.
What can be public
Your project tracking key appears in the browser script URL. That is expected. It identifies where ordinary page and event beacons belong; it is not authorization to read your analytics, access your account, or prove that a payment happened.
What must stay private
- Clarvivo API tokens
- Payment-provider webhook signing secrets
- The project ingest secret for custom revenue
- OAuth or service credentials used by integrations
Keep these values in secure dashboard settings, a server-side environment, or a client’s protected credential store. Never paste them into frontend code, analytics event properties, a public issue, or an agent prompt.
Use scoped and revocable access
Use the narrowest API token scopes needed for an agent or integration. Revoke tokens instead of sharing a long-lived credential across people or projects. Configure project host and path boundaries so browser tracking stays with the site it is intended to measure.