---
slug: site-id-und-write-key
title: "Where do I find the site ID, write key and server key?"
category: einstieg
locale: en
updated: 2026-10-17
keywords: ["write key","server key","site ID","key","API key"]
questions: ["Which key goes where, and which one may be public?","Is the write key secret?","Where do I find my key?","What is the difference between write key and server key?","Where do I create a server key?","Where do I find the read key for Claude?"]
url: https://bench.metrunio.com/en/help/site-id-und-write-key
---

# Where do I find the site ID, write key and server key?

**Which key goes where, and which one may be public?**

Site ID and write key are in the portal under “Setup” and belong in the browser tracking code. You create the server key in “Setup” on the “Server Events API” tab with “Create server key”; it is secret, belongs only in your backend and is shown in full only when it is created. Read keys for Claude and your own analyses are under “Exports & AI connections”, in the “API access” section.

| Value | Visibility | Used for |
| --- | --- | --- |
| Site ID | public | tracking code, Server Events API |
| Write key | publicly visible, bound to domains | browser: GTM tag or snippet |
| Server key | secret | Server Events API, webhooks, HMAC signature |
| Read key | secret, read-only | read API and MCP, created under “Exports & AI connections” |

The write key appearing in your page source is not a mistake: it is bound to the allowed domains. A foreign website cannot use it in its visitors’ browsers, because the collector checks the origin and answers with DOMAIN_NOT_ALLOWED. A request from outside a browser is not stopped by this check: anyone who copies the key can report events with it, purchases included. So report purchases from your server as well, with the Server Events API or a plugin. Then value and currency come from the server, even if someone reported the same order number through the browser before.

> **Caution:** The server key must never appear in browser code, a Git repository or a tag manager. If it has become visible, generate a new one in “Setup” on the “Server Events API” tab. The old key is revoked immediately; a revoked key receives the answer SERVER_KEY_INVALID.

## Also asked

- Is the write key secret?
- Where do I find my key?
- What is the difference between write key and server key?
- Where do I create a server key?
- Where do I find the read key for Claude?

## Related

- https://bench.metrunio.com/en/help/api-keys-rotieren
- https://bench.metrunio.com/en/help/erlaubte-domains
- https://bench.metrunio.com/en/help/server-events-api
- https://bench.metrunio.com/en/help/mcp-anbinden