---
title: "Domains, site keys and the install card"
description: "Register a domain, copy its public site key, open the install card, and manage the per-domain settings, key rotation and deletion in Backoffice."
canonical_url: "https://noxtica.com/docs/backoffice/domains/"
markdown_url: "https://noxtica.com/docs/backoffice/domains/index.md"
last_updated: 2026-10-27
published: 2026-10-27
section: "backoffice"
section_title: "Backoffice Guide"
site: "Noxtica"
language: "en"
source: markdown
---

# Domains, site keys and the install card

A domain is a website origin that you register in Backoffice. Each domain gets a site key that the collector script uses to send results for that origin. A workspace Admin registers the domain here, copies the key and then installs the script from Script & Consent.

## What it is

Availability: Availability depends on your plan, role and the modules enabled for your organisation.

- **Domains list** (`Backoffice → Administration → Domains`): one row per registered origin with its tenant (platform operators only), origin, masked site key, status, tracker switch, retention, last seen time and actions.
- **Site key**: a public identifier. It is safe to put in page source because it is bound to the registered origin: the collector accepts submissions from that origin only. Keep one domain, and one key, per environment. A site key is not a secret API key; server keys live under [Integrations and API pages](https://noxtica.com/docs/backoffice/integrations/).
- **Install Noxtica card**: a card under the list. It links to **Integrations & API → Script & Consent → Snippets**, the single place that holds install snippets, consent modes and checks. The card does not duplicate them.
- **Domain detail** (`/domains/<id>`): the full record for one origin, with the tabs **Configuration**, **Risk rules**, **Integration**, **Relay** and **Recent events**.

The full install walkthrough is in [Install & Browser Runtime](https://noxtica.com/docs/browser-runtime/). Consent behaviour is in [Consent modes, GPC and Google Consent Mode](https://noxtica.com/docs/sdk/consent/).

## Prerequisites

- The Admin role in the workspace. Viewers and Analysts do not see the **Domains** page in the sidebar. See [Backoffice guide](https://noxtica.com/docs/backoffice/overview/).
- An authenticator app. Creating, changing, rotating and deleting a domain each ask for a fresh MFA check.
- The exact origin to register: scheme, host and optional port, with no path, query or fragment. Use `https`. Plain `http` is accepted for `localhost` and `127.0.0.1` development only.
- Room in your plan's domain limit. Your plan sets the maximum number of domains.
- Some per-domain controls (proof-of-work attestation, GPU VM rollout, cookie content capture, the Client RUM sample rate) are changed by Noxtica operators on request. They appear read-only to a workspace Admin.

## Steps

### 1. Add a domain

1. Open `Backoffice → Administration → Domains`.
2. Select **Add domain**.
3. Enter the **Origin URL**, for example `https://www.example.com`. Do not include a path, query string or hash.
4. Select **Create domain** and enter your MFA code when asked.

The console checks the format before it sends the request, and the server checks it again:

| Rule | Message |
| --- | --- |
| Must parse as a URL | `Invalid URL format. Expected: https://example.com` |
| No path, query or hash | `Origin should not include path, query, or hash (e.g., https://example.com)` |
| `https` only, except localhost | `HTTP origins are only allowed for localhost development` |
| Each origin once | `Origin already registered` |
| Plan limit | `Maximum domains limit reached for this tenant` |

On success a toast reads: "Domain "<host>" created in API consent mode: the page check stays off until your site calls setConsent()." The new row has the status **Active**.

### 2. Copy the site key

In the **Site key** column the key is masked. Select **Reveal site key** to show it, then **Copy**. The domain detail header has the same **Site key** copy button. Use a separate domain, with its own key, for staging and production.

### 3. Install the script

Select **Install Noxtica → Script & Consent** on the Domains page, or open the domain and use the **Integration** tab. Both open `Integrations & API → Script & Consent` on the **Snippets** tab. The domain tab link preselects the domain (`?tab=snippets&domain_id=<id>`). Copy the core script and add it to every page. The walkthrough is [Install & Browser Runtime](https://noxtica.com/docs/browser-runtime/).

### 4. Know the consent default for new domains

A domain that you create now starts in **API** consent mode. Until your site calls `noxticaClient.setConsent()` (or `noxtica('setConsent', …)`) with the `deviceId` category granted:

- the page check is skipped, and `noxtica:collected` carries `skipped: 'consent_required'`;
- nothing persistent is written on the visitor's device;
- only protected actions run.

Domains that existed before this default keep the mode they have. To change a domain's mode, including **Not required**, open the domain and use `Configuration → Client consent mode` (options **Not required**, **API**, **Cookie**), or use `Script & Consent → Consent & extensions`. A cookie mode takes a cookie name (1 to 64 letters, digits, underscores, dots or hyphens) and an optional value (up to 128 characters from letters, digits and `_ . : % + -`). See [Consent modes, GPC and Google Consent Mode](https://noxtica.com/docs/sdk/consent/).

### 5. Review and change per-domain settings

Open a domain from the list. The **Configuration** tab is a stack of cards:

| Card | What you can change | Bounds and notes |
| --- | --- | --- |
| Canonical origin | Nothing; copy the origin | Submissions are accepted from this origin only. Several origins per domain are not available |
| Lifecycle | **Status** (enable or disable), **Tracker collection** | Disabling stops new submissions; existing data stays. With the tracker off the script is served but does not POST submissions |
| Retention | **Retention (days)**, **Check interval (days)**, **Token refresh interval** | Retention override 1 to 365 days; empty inherits the tenant value. Check interval 1 to 30 days. Token refresh 30 seconds to 24 hours, never below your plan floor. **Effective** shows the value the script receives |
| Client log level | Console verbosity of the script's own diagnostics: Silent, Error, Warn, Info, Debug, or SDK default | A `data-log-level` attribute or an `init` option always overrides it |
| Client consent mode | **Not required**, **API**, **Cookie** | See step 4 |
| Tracker policy | VM telemetry, Debug signals, Browser interactions, Heatmaps, User journeys, App events, Sample rate | Sample rate 0.0 to 1.0. Heatmaps and User journeys need Browser interactions and default to off |
| Hardware Attestation | PoW attestation, GPU VM, rollout percentage | Operator-controlled. Runs real work in the visitor's browser |
| Cookie capture | Cookie content capture | Operator-controlled. Off by default; needs a documented lawful basis |
| Client RUM | Sample rate | Operator-controlled |

The other tabs:

- **Risk rules**: rules added here apply to this origin only. Tenant-wide rules from `Detection & Collection → Rules & Risk Scoring` apply alongside them. See [Detection and collection settings](https://noxtica.com/docs/backoffice/detection-settings/).
- **Integration**: a link to Script & Consent for this domain.
- **Relay**: a read-only list of first-party relay hostnames for this domain, with the CNAME target and TXT record to publish. Provision hostnames in `Integrations & API → Relay Hostnames`. See [Content Security Policy, hosts and first-party relay](https://noxtica.com/docs/sdk/csp-and-relay/).
- **Recent events**: audit entries for this domain, such as updates and rotations. See [Audit log and data export](https://noxtica.com/docs/security/audit-log-and-exports/).

The header of the detail page shows four counters: **Submissions (30d)**, **Blocked**, **Challenged** and **Pass-through rate**. A **Verdict funnel (last 30 days)** card shows how submissions narrow from intake to decisions. Counts under the anonymity threshold are hidden, and a hidden stage is not a zero.

### 6. Disable, rotate or delete

- **Disable**: on the list use the power icon; on the detail page use **Lifecycle → Status**. A disabled domain shows **Revoked** on the list and **Disabled** on the detail page. **Enable** resumes collection with the same site key.
- **Rotate**: **Rotate key** on the detail page, or the rotate icon on the list. The current key stops working immediately, so update every snippet that uses it before you rotate. The change needs MFA.
- **Delete**: the trash icon on the list, or **Delete** on the detail page. Type the host name to confirm. Deletion removes the domain, its site key and the data associated with it. It cannot be undone.

### 7. Export the list

Select **Export CSV** above the table to download the domains you can see.

## Verify it works

- The domain row is **Active**, and its masked site key matches the key in your snippet.
- After the script runs on your site, the **Last seen** column shows a time. `Script & Consent → Check it works` walks through the same check on the page side.
- In API consent mode, open your site and confirm that your consent banner calls `setConsent()`. Until it does, the page check is skipped by design.
- On the domain detail page, **Submissions (30d)** counts rise once traffic is collected.
- After you change a setting or rotate the key, `Recent events` lists that update or rotation.

## Troubleshooting

| Symptom | Cause | Fix |
| --- | --- | --- |
| **Add domain** is missing | The Domains page needs the Admin role | Ask a workspace Admin |
| `Origin should not include path, query, or hash` | You entered a full page URL | Enter just `https://host` |
| `HTTP origins are only allowed for localhost development` | You used `http` for a real host | Register the `https` origin |
| `Origin already registered` | The origin exists in the workspace, or the same origin is registered elsewhere | Use the existing domain, or ask your account team |
| `Maximum domains limit reached for this tenant` | Your plan's domain limit | Delete an unused domain or ask your account team |
| The script loads but no page check appears | A new domain starts in API consent mode | Call `setConsent()` after consent, or change the mode under Client consent mode |
| Collection stopped after a rotation | Snippets still carry the old key | Copy the new key into every snippet |
| No submissions, tracker off | **Tracker collection** is off for the domain | Turn it on under Lifecycle |
| The PoW attestation, cookie capture or Client RUM controls are greyed out | These controls are operator-only | Ask your account team |
| A change asks for a code again | A sensitive change needs a fresh MFA check | Enter the authenticator code |

## Related

- [Backoffice guide: navigation, roles and shortcuts](https://noxtica.com/docs/backoffice/overview/): roles, palette and shortcuts.
- [Install & Browser Runtime](https://noxtica.com/docs/browser-runtime/): the install walkthrough.
- [Script attributes and client options](https://noxtica.com/docs/sdk/script-attributes/): script tag attributes such as `data-log-level`.
- [Consent modes, GPC and Google Consent Mode](https://noxtica.com/docs/sdk/consent/): consent modes and the API.
- [Protected actions: client trigger and server check](https://noxtica.com/docs/sdk/protected-actions/): what still runs without consent.
- [Detection and collection settings](https://noxtica.com/docs/backoffice/detection-settings/): tenant-wide rules, cost levels and probes.
- [Roles and permissions](https://noxtica.com/docs/security/roles-and-permissions/): who can manage domains.