# Script reference

> Reference for the atrby script: its data attributes, the window.atrby functions, what it sends, and what it never stores.

Canonical: https://atrby.site/docs/tracker
Last updated: 2026-10-21

Everything the script reads, sends and exposes on `window.atrby`. About 2 kB gzipped.

## Attributes

| Attribute | Type | Required | Description |
| --- | --- | --- | --- |
| `data-site` | string | Required | Your site key, `st_…` |
| `data-cookie` | "true" | Optional | First-party visitor cookie. Honoured only when the site is in cookie mode. See [privacy modes](https://atrby.site/docs/privacy). |
| `data-autocapture` | "true" | Optional | Records clicks on `a`, `button` and `[data-atrby]` elements as an event named `click`. |
| `data-api` | URL | Optional | Where events are sent. Default `https://app.atrby.site/api/ingest`. |
| `data-replay` | "true" | Optional | Loads the session replay recorder, `atrby-replay.js`, from the same place as the script. Records only when replay is on for the site. See [sessions](https://atrby.site/docs/sessions). |

## Functions

```js
atrby.track("signup_clicked");   // custom event
atrby.goal("trial_started");      // custom event labelled as a goal
atrby.identify(user.id);          // link this visit to your user id
atrby.ids();                      // { atrby_sid, atrby_site } for checkout metadata
atrby.pageview();                 // record a pageview yourself (rarely needed)
atrby.revenue(49, { currency: "USD" }); // browser-side revenue, Overview only
```

| Function | What it does |
| --- | --- |
| `track(name)` | Custom event. Name up to 128 characters. Properties are accepted but not stored. |
| `goal(name)` | Same as track, labelled as a goal in the visit timeline. |
| `identify(userId)` | Stores your user id with this visit and sends right away. See [identify](https://atrby.site/docs/identify). |
| `ids()` | Returns the visit id and site key to put in checkout metadata. |
| `pageview()` | Sent for you on load and on every pushState or back/forward navigation. A repeat for the same path is skipped. |
| `revenue(amount, {currency})` | Amount in major units (49 = $49). Counts in Overview totals but not on the Revenue screen. |

Calls made before the script loads aren't queued, so guard them with `window.atrby?.`

## What gets sent

- The page path and query, the referrer, and the visit's landing page, referrer and UTM tags, so a payment later in the visit keeps its source.
- A visit id kept in `sessionStorage` as `atrby_sid`. It ends when the tab closes.
- Core Web Vitals (LCP, INP, CLS, FCP, TTFB), once per page, when the visitor leaves or switches tabs.
- With `data-replay` and replay on: a recording of the page (its structure and text, pointer, clicks, scrolling and window size) every 10 seconds to `/api/replay`, gzipped. Form values are masked and password fields left out; see [sessions](https://atrby.site/docs/sessions).

Events are batched, up to 8 at a time or every 0.8 seconds, and sent with `sendBeacon` so they survive the page closing.

## What doesn't

- No cookies or local storage in the default mode. The visitor id is made on our server; see [privacy modes](https://atrby.site/docs/privacy).
- No IP address is stored. Country comes from the network edge as a two-letter code.

Bots, link prefetches and other hostnames are dropped before anything is stored. AI crawlers are counted separately and never billed.

## Related
- [Events and goals](https://atrby.site/docs/events)
- [Identify users](https://atrby.site/docs/identify)
- [Revenue attribution](https://atrby.site/docs/revenue)