MailnapticSign inCreate an accountHelp CenterAPI docs

Regenerating Your Tracking Key

Rotate your site tracking key for security

Regenerating Your Tracking Key

Your site tracking key authenticates event data sent from your website to Mailnaptic. If you suspect the key has been compromised or you simply want to rotate it as a security best practice, you can regenerate it at any time.

When to regenerate

Consider regenerating your tracking key in these situations:

  • Key exposure: The key was accidentally committed to a public repository, shared in a support ticket, or otherwise exposed.
  • Team member offboarding: A developer or contractor who had access to the key has left your organization.
  • Routine rotation: Your security policy requires periodic key rotation (e.g., every 90 days).
  • Suspicious traffic: You notice unexpected events appearing in your tracking data that may indicate unauthorized use of your key.

How to regenerate

  1. Go to Organization → Site Tracking.
  2. Click the Regenerate Key button next to your current site tracking key.
  3. Confirm the action in the dialog. This immediately invalidates the old key.
  4. Copy the new key and update your tracking snippet on all pages where it is installed.

What happens when you regenerate

EffectDetails
Old key stops working immediatelyAny ingest requests using the old key will be rejected with a 401 status.
New key is active immediatelyEvents sent with the new key are accepted right away.
Existing event data is preservedHistorical events, contact attributions, and anonymous sessions are not affected.
Snippet must be updatedYou need to deploy the updated snippet code to your website.

Minimizing downtime

Between regenerating the key and deploying the updated snippet, events from your website will fail to authenticate. To minimize this gap:

  1. Prepare your deployment pipeline or CMS so you can update the snippet quickly.
  2. Regenerate the key in Mailnaptic.
  3. Immediately copy the new snippet code from the Organization → Site Tracking page.
  4. Deploy the updated snippet to your site.

If your site serves the snippet from a tag manager (e.g., Google Tag Manager), update the custom HTML tag with the new key and publish the container.

Updating the snippet

The tracking snippet includes your site key in a configuration attribute. After regeneration, the new snippet code is available on the Site Tracking settings page. The only change is the site_key value — the rest of the snippet remains identical:

<script src="https://your-mailnaptic-domain/tracking-script.js"
  data-site-key="YOUR_NEW_KEY_HERE"
  async></script>

Verifying the new key

After deploying the updated snippet:

  1. Visit a page on your site and open the browser's network tab.
  2. Look for the POST request to the Mailnaptic ingest endpoint.
  3. Confirm it returns a 200 status.
  4. In Mailnaptic, check Domains → Tracking to verify events are flowing in with updated timestamps.

Important: Regenerating the key does not affect email-to-web identity linking. Identity tokens are independent of the site tracking key.

·

More in Site Tracking