Docs · First-party
Visitor tracking methods
CRM is historical truth. Visitor signals are live demand outside the CRM. All three methods write to the same /api/ingest/v1 pipeline → reveal → Revenue Graph → Scout. Methods are additive.
| Method | Auth | Who installs | Signal depth |
|---|---|---|---|
| Script tag | Write-only public key (bpk_) | Developer pastes one <script> in <head> | Full behavioral — page views, dwell, scroll, forms, bp.identify() |
| Google Tag Manager | Same bp.js public key | Marketing / RevOps publishes via GTM (no code deploy) | Same as script tag — GTM loads bp.js |
| Cloudflare Worker | HMAC-SHA256 (bpk_ + bsk_) | DevOps deploys Worker + attaches yourdomain.com/* route | Path, referrer, IP/geo, UA; high-value paths → Scout intent |
Script tag
When: You control the site codebase and want maximum depth.
Google Tag Manager
When: GTM already runs on your site; engineering bandwidth is scarce.
Cloudflare Worker
When: You need snippet-free capture, or browsers block client JS.
Enterprise defaults
- No third-party cookies. No cross-site tracking.
- Public keys are write-only; signing secrets never ship to the browser.
- Recommended stack: Cloudflare Worker (coverage) + GTM (behavioral depth).
- Configure in-app: Settings → Runtime → First-party (
#first-party).
Related: Ingest API (HMAC)