Getting started
Where do I find the site ID, write key and server key?
Site ID and write key are in the portal under “Setup” and belong in the browser tracking code. You create the server key in “Setup” on the “Server Events API” tab with “Create server key”; it is secret, belongs only in your backend and is shown in full only when it is created. Read keys for Claude and your own analyses are under “Exports & AI connections”, in the “API access” section.
Which key goes where, and which one may be public?
| Value | Visibility | Used for |
|---|---|---|
| Site ID | public | tracking code, Server Events API |
| Write key | publicly visible, bound to domains | browser: GTM tag or snippet |
| Server key | secret | Server Events API, webhooks, HMAC signature |
| Read key | secret, read-only | read API and MCP, created under “Exports & AI connections” |
The write key appearing in your page source is not a mistake: it is bound to the allowed domains. A foreign website cannot use it in its visitors’ browsers, because the collector checks the origin and answers with DOMAIN_NOT_ALLOWED. A request from outside a browser is not stopped by this check: anyone who copies the key can report events with it, purchases included. So report purchases from your server as well, with the Server Events API or a plugin. Then value and currency come from the server, even if someone reported the same order number through the browser before.
Caution
The server key must never appear in browser code, a Git repository or a tag manager. If it has become visible, generate a new one in “Setup” on the “Server Events API” tab. The old key is revoked immediately; a revoked key receives the answer SERVER_KEY_INVALID.
Last reviewed on 17 Oct 2026
In the customer portal
Also asked
- Is the write key secret?
- Where do I find my key?
- What is the difference between write key and server key?
- Where do I create a server key?
- Where do I find the read key for Claude?
Related articles
- How do I rotate or revoke a key?
What do I do if a key was published by accident?
You renew the write key and the server key in “Setup”, the server key on the “Server Events API” tab, where you can also revoke it. Read keys are revoked under “Exports & AI connections”, in the “API access” section, where you also create a new one. A new key is shown in full only once, and the old one stops working immediately.
- Why do I have to allow domains?
What does DOMAIN_NOT_ALLOWED mean and how do I add a domain?
The write key is visible in your page source; to stop a foreign website using it in its visitors’ browsers, the collector checks the origin of the request. If the domain is not in the allowed list, the event is rejected with DOMAIN_NOT_ALLOWED. A request from outside a browser is not stopped by this check, so it is best to report purchases from your server as well.
- How do I report conversions server-side?
How do I send events from my shop, CRM or backend?
Through POST /v1/server/events to the collector, with the server key in the authorization header. The portal shows the address and the ready-made call for your website under “Setup” on the “Server Events API” tab. The call is independent of the browser and therefore robust against ad blockers and short-lived cookies.
- How do I connect my own AI tool?
Is there an MCP server for Metrunio?
Through Metrunio’s MCP server. It exposes the same read tools as the portal chat. Claude and ChatGPT sign in via OAuth: you choose in the portal which account they may read. Other tools use an API key of scope “read”, the same one a script would use for /v1/data.