# Tag reference

## The snippet

```html
<script async src="https://konta.la/v1/t.js?k=pk_live_..."></script>
```

The script must stay a classic script: never add `type="module"`.

## Script attributes

Add these to the script tag to change how it behaves.

| Attribute | Default | What it does |
| --- | --- | --- |
| `data-spa` | on | Send a page view for each change of page in a single-page app. Set `false` to count full page loads only. |
| `data-consent` | `granted` | The consent state before your code says otherwise: `granted`, `unknown` or `denied`. See [Consent](/docs/data-capture/consent). |
| `data-consent-hold` | `10000` | How long, in milliseconds, events wait for an answer while consent is unknown. |
| `data-disable-storage` | off | Run without cookies: ids are kept in memory for the page only. |
| `data-session-timeout` | `30` | Minutes without activity before a visit ends. |
| `data-device-max-age` | `63072000` | Seconds the device cookie lasts. |
| `data-cookie-prefix` | `pt_` | Prefix for the tag's cookie names. |
| `data-cookie-domain` | this host | Set a parent domain, such as `example.com`, to share visits across subdomains. |
| `data-cookie-path` | `/` | Cookie path. |
| `data-cookie-samesite` | `Lax` | Cookie SameSite. `None` forces `Secure`. |
| `data-cookie-secure` | on HTTPS | Cookie Secure flag. |
| `data-max-batch-events` | `20` | Most events in one request. |
| `data-endpoint` | from the script's address | Where events are sent, for a first-party proxy. |
| `data-debug` | off | Log every captured event to the console, and warn about delivery problems. |

Boolean attributes are on when present, or when set to `true`, `1`, `on` or `yes`.

## JavaScript functions

| Function | What it does |
| --- | --- |
| `pageTracker.consent(state)` | Set consent to `'granted'`, `'denied'` or `'unknown'`. |
| `pageTracker.getConsent()` | Return the current consent state. |
| `pageTracker.identify({ user, org })` | Name the signed-in user and their organisation. `identify({})` signs them out. |
| `pageTracker.pageType(type)` | Declare the current page's type, such as `'pdp'`. |

All of them live on `window.pageTracker` once the tag has loaded.
Before then, push calls onto a queue, and the tag runs them in order when it starts:

```js
window.pageTrackerQueue = window.pageTrackerQueue || [];
window.pageTrackerQueue.push(['consent', 'granted']);
window.pageTrackerQueue.push(['identify', { user: 'user-42' }]);
window.pageTrackerQueue.push(['pageType', 'checkout']);
```

## HTML attributes

| Attribute | What it does |
| --- | --- |
| `data-ac-event="add_to_cart"` | Declares what a click on this element, anything inside it, or its form does. Use a [click type](/docs/data-capture/page-and-click-types) code. |
| `data-ac-ignore` | Leaves out every click, swipe and friction signal inside this element. |
| `data-ac-mask` | Keeps only that something inside this element was clicked or swiped. |

## Cookies

| Cookie | Holds | Lasts |
| --- | --- | --- |
| `pt_did` | The anonymous device id | 2 years, or less where the browser caps it |
| `pt_sid` | The visit's id and when it was last active | 30 minutes after the last activity |

To join a server-side event to a browser visit, read `pt_did` and the part of `pt_sid` before the dot.

## Sending

The tag sends with `navigator.sendBeacon`, or `fetch` with `keepalive` where that is not available, as plain text so there is never a CORS preflight.
It sends what it holds when the page is hidden or closed, and never uses the `unload` event, so your pages stay eligible for the browser's back and forward cache.