Script reference
Everything the script reads, sends and exposes on window.atrby. About 2 kB gzipped.
Updated 21 Oct 2026
Attributes
| Name | Type | Required | Description |
|---|---|---|---|
| data-site | string | Required | Your site key, st_… |
| data-cookie | "true" | Optional | First-party visitor cookie. Honoured only when the site is in cookie mode. See privacy modes. |
| data-autocapture | "true" | Optional | Records clicks on a, button and [data-atrby] elements as an event named click. |
| data-api | URL | Optional | Where events are sent. Default https://app.atrby.site/api/ingest. |
| data-replay | "true" | Optional | Loads the session replay recorder, atrby-replay.js, from the same place as the script. Records only when replay is on for the site. See sessions. |
Functions
atrby.track("signup_clicked"); // custom event
atrby.goal("trial_started"); // custom event labelled as a goal
atrby.identify(user.id); // link this visit to your user id
atrby.ids(); // { atrby_sid, atrby_site } for checkout metadata
atrby.pageview(); // record a pageview yourself (rarely needed)
atrby.revenue(49, { currency: "USD" }); // browser-side revenue, Overview only| track(name) | Custom event. Name up to 128 characters. Properties are accepted but not stored. |
|---|---|
| goal(name) | Same as track, labelled as a goal in the visit timeline. |
| identify(userId) | Stores your user id with this visit and sends right away. See identify. |
| ids() | Returns the visit id and site key to put in checkout metadata. |
| pageview() | Sent for you on load and on every pushState or back/forward navigation. A repeat for the same path is skipped. |
| revenue(amount, {currency}) | Amount in major units (49 = $49). Counts in Overview totals but not on the Revenue screen. |
Calls made before the script loads aren't queued, so guard them with window.atrby?.
What gets sent
- The page path and query, the referrer, and the visit's landing page, referrer and UTM tags, so a payment later in the visit keeps its source.
- A visit id kept in
sessionStorageasatrby_sid. It ends when the tab closes. - Core Web Vitals (LCP, INP, CLS, FCP, TTFB), once per page, when the visitor leaves or switches tabs.
- With
data-replayand replay on: a recording of the page (its structure and text, pointer, clicks, scrolling and window size) every 10 seconds to/api/replay, gzipped. Form values are masked and password fields left out; see sessions.
Events are batched, up to 8 at a time or every 0.8 seconds, and sent with sendBeacon so they survive the page closing.
What doesn't
- No cookies or local storage in the default mode. The visitor id is made on our server; see privacy modes.
- No IP address is stored. Country comes from the network edge as a two-letter code.
Bots, link prefetches and other hostnames are dropped before anything is stored. AI crawlers are counted separately and never billed.