Snippets

The snippet is the one piece of Pact that runs on your website. It is a small async script that resolves the right personalization variant for each visitor, renders it, and reports exposures and conversions back to Pact. Drop it in once; every block you create afterward is served without another code change.

Live

The snippet is served from a real endpoint and driven by a real write key. The tag is generated per tenant and host by GET /v1/personalize/snippet; the script itself is served at GET /p.js.

Getting your tag

GET /v1/personalize/snippet?host=<your-domain> returns the exact tag to paste, along with the write key so a marketer can verify it matches what the snippet sends in event payloads:

json

{
  "tag": "<script async src=\"https://app.pact.place/p.js\" data-tenant=\"…\" data-host=\"example.com\"></script>",
  "tenant_id": "…",
  "host": "example.com",
  "write_key": "…"
}

In the app, the Snippet page under Personalize renders this in a code block with one-click copy. Paste the tag into your site's <head> (or your tag manager) and you're done.

What the tag does

code

<script async src="…/p.js" data-tenant data-host>
        │
        ▼
  on load: GET  /v1/personalize/serve   → resolved variants for this host + visitor
  on show: POST /v1/personalize/expose  → records the exposure
  on goal: POST /v1/personalize/convert → records the conversion

The /p.js script is served with Cache-Control: public, max-age=300, stale-while-revalidate=86400, so it edge-caches aggressively without going stale for long. It is embedded directly from the API host — the customer site loads <script src="https://app.pact.place/p.js">.

The write key

The public serve, expose, and convert calls carry no bearer token — they execute in your visitors' browsers, where a secret API key can't live. Instead each request is signed with a per-tenant write key, derived by HMAC in core.personalization.signing (tenant_write_key). Pact verifies it with verify_write_key; a mismatched or cross-tenant key fails with a 401.

Rotation is instant and global

Each tenant's write key is HMAC-derived (tenant_write_key = HMAC_SHA256(secret, tenant_id)) from a single platform-wide signing secret (PERSONALIZATION_HMAC_SECRET). Rotating that secret invalidates every active snippet across all tenants at once — useful if a key is ever exposed. Re-fetch the tag after rotation to get the new value.

Requires the marketing module

Both GET /v1/personalize/snippet and GET /p.js are gated behind require_module("marketing"). Enable the marketing module before installing.

PersonalizationBlocks, variants, targeting rules, and winner promotion.ConsentThe snippet reads consent purposes before it measures anything.TrackingThe broader event-capture surface the snippet contributes to.