Script tag

Add the tag before </head>:

<script
  src="https://api.pixelfox.app/signals.min.js"
  data-signals-key="sig_live_YOUR_KEY"
  data-signals-host="https://api.pixelfox.app"
  defer
></script>

The tag initializes automatically on DOMContentLoaded. It is ~9 kB gzipped, loads defer (never blocks rendering), and fails silent - a missing key logs one console warning and does nothing else.

Attributes

Manual initialization

For SPAs or custom setups, suppress auto-init and configure in code:

<script src="https://api.pixelfox.app/signals.min.js" data-no-init="true" defer></script>
<script>
  window.addEventListener("DOMContentLoaded", () => {
    signals.init({
      apiKey: "sig_live_YOUR_KEY",
      host: "https://api.pixelfox.app",
      productPathPrefixes: ["/shop", "/collections"],
    });
  });
</script>

See the SDK API reference for every option.

Where the script is served from (CDN)

signals.min.js is served from the same origin as the ingest API, with CDN-friendly headers: Cache-Control: public, max-age=300, stale-while-revalidate=86400, a content-addressed ETag, gzip, and Access-Control-Allow-Origin: *. That means:

• Default - load it straight from the ingest host (the snippet above). Browsers and any CDN in front cache it; a new SDK release propagates within five minutes.

• Your own domain (recommended) - add a CNAME so both the script and every event request come from your domain:

  Type	Name	Value
  CNAME	t	connect.pixelfox.app

  Save t.yourstore.com during onboarding (Install → Serve from your own domain) or in Settings → Site → First-party domain, and use it in both src and data-signals-host. TLS is issued automatically on the first request. See First-party tracking domain for what this changes (ad-blocker resilience, 2-year cookie life).

• Your own CDN - any CDN can also sit directly in front of the ingest host; the cache headers above are written for that. Point src at the CDN URL and keep data-signals-host on the ingest (or first-party) host so events still reach the API.

Gotchas

• Single-page apps - route changes are tracked automatically (the SDK wraps history.pushState); you do not need to call track("$pageview") manually.
• Content Security Policy - allow script-src for the CDN host and connect-src for your ingest host. If you use vendor pixels, their usual CSP entries also apply.
• Ad blockers - some blockers stop any analytics script. Server-side fan-out still works for events sent from your backend (see the WooCommerce/Laravel purchase helpers).