Janus Client SDK
A lightweight JavaScript library for tracking events from web applications. Automatically handles batching, retries, rate limiting, and persistence.
Lightweight (~3KB)Auto RetryBatchingPersistence
Setting Up API Keys
Generate an API Key#
1. Log in to Janus dashboard
2. Go to Settings (API Keys tab)
3. Click "Generate New Key"
4. Enter a name (e.g., "Production Website")
5. Choose a scope — **Ingest** for anything in a browser, **Full access** for MCP and server-side reads
6. Copy the key immediately - it will only be shown once!
Key Scopes#
Every key has a scope that decides what it can reach.
**Ingest** — sends events. Cannot read events, stats, funnels or usage, and cannot create or delete keys. This is the default, and the only kind that belongs in a public browser bundle.
**Full access** — everything an Ingest key can do, plus reading all of your analytics and managing keys. It carries your whole account, so treat it like a password: MCP configs, server environment variables, nothing a visitor can download.
A Full access key used in browser code lets anyone who views source read your entire event history and mint more keys. Pick Ingest unless you specifically need reads.
Configure Allowed Origins#
To further restrict a key, limit it to your domain(s). When creating the key, add your origins:
Allowed Origins
https://myapp.comhttps://www.myapp.com
Why this matters#
Anyone who views your page source can copy the key out of it. Origin restrictions stop that copy working from another website.
They are a second layer, not the main one. The check relies on the browser sending an Origin header, so a request made outside a browser — curl, a script, a server — is not restricted by it. Scope is what actually limits a leaked key: an Ingest key can only ever add events, wherever it is used from.
Key Types by Use Case#
| Use Case | Scope | Key Configuration |
|---|---|---|
| Production website | Ingest | Add your production domain(s) to allowed origins |
| Development | Ingest | Add http://localhost:5173 (or your dev port) |
| Server-side tracking | Ingest | Leave allowed origins empty (key works from anywhere) |
| MCP server / AI agent | Full access | Separate key, kept in your MCP config — never in browser code |
| Reading data from your backend | Full access | Separate key, kept in a server environment variable |
Need Help?
If you have questions or run into issues, check out our troubleshooting guide or reach out to our support team.
Troubleshooting Guide