Integration keys

The server proxy needs permission to read your site's findings and send back results. An integration key gives it that access for one site without using your personal sign-in. You do not need one for the browser script, which uses a public site ID.

site_ public site ID
Identifies the site in website HTML. It is not a credential.
key_ private integration key
Authorises server-side requests for one site. Keep it in server configuration, never website code, URLs, or source control.
vca_ agent access token
Lets a coding agent use account setup tools. It is not an integration key. Manage it in Agent access.
  1. Open the site's Setup tab and create a key. Give it a name that helps you recognise where it is used, such as Production or Local development.
  2. Copy the full key into your server's secret storage. It is shown only once.
  3. To replace a key, create another, deploy it, and check that its last-used time updates. Then revoke the old key. Both keys work during the change, so there is no interruption.

Setup lists your keys, when they were created, and when they were last used. You can revoke a key without affecting the others. If a key has been exposed, revoke it straight away.

Use an on server-side requests. For example, read this key's site state with:

curl --fail --header "Authorization: Bearer $VERSION_COMPARE_KEY" \
  https://version.compare/api/integration/state

Set VERSION_COMPARE_KEY in your server environment to the real key_ value. This request returns the site's allowed websites, goals, discovered sets, and counts. Never send invented visits or successes.

For coding-agent setup, use Agent access instead.