Script tag reference

The script tag has six attributes it reads, plus one retired attribute it ignores. Everything else about how a site is tracked lives in your dashboard settings, not in the tag.

#Attributes

data-siterequired

Your site id. Without it, the tracker logs a console warning and does nothing else: no requests are sent.

data-cookiesopt-in, default: absent

The only value that means anything is on, which puts the tracker into cookie mode and lets it store a first-party _pw_id identifier for a year. Absent means cookieless, which means no cookie is written or read at all, and absent is the default, so a snippet without this attribute never stores anything persistent on a visitor's device. Your install snippet only carries it when the site's tracking mode is set to cookie-based in dashboard settings, so cookieless sites need no consent banner for it.

data-endpointdefault: script origin + /api/collect

Overrides where events are POSTed. By default the tracker sends to /api/collect on whichever origin served tracker.js itself (not the page's own origin), so a script loaded from mrkr.app and embedded on your site still reaches Mrkr rather than 404ing against your own domain.

data-replay-endpointdefault: script origin + /api/replay

Overrides where session-replay batches are sent. Only relevant when replay is enabled for the site.

data-mask-inputdefault: 1

Controls session-replay input masking. 1 (the default) masks every form input's value in recordings. Set to 0 to record typed values in ordinary text fields. Password and email inputs stay masked either way, regardless of this setting.

data-debugdefault: 0

Set to 1 to log the tracker's requests and the server's responses to the console, prefixed [mrkr]. See Verify your install.

data-autocaptureno longer used

Retired in September 2026, when click autocapture was removed outright. The attribute is ignored and can be deleted from your snippet. See What Mrkr records automatically.

#What's controlled from the dashboard instead

A few settings deliberately don't live on the snippet at all:

• Tracking mode (cookieless vs. cookie-based): /dashboard/settings, with the single exception of data-cookies above. The server reads your mode from your site's row, but the decision to *store* a cookie happens in the browser before any request is made, so a cookie-mode site carries that one attribute on the tag.
• Session replay (on/off, and sample rate): /dashboard/settings
• Excluded paths: /dashboard/settings

These are stored against your site's row in the database and read fresh on every request that hits the collect endpoint. Flip a toggle in the dashboard and it takes effect on the very next event: nobody has to re-paste the snippet, redeploy, or wait for a cache to expire. That's also why the tag barely changes shape based on your settings: the same <script> tag works whether replay is on or off. The one exception is data-cookies, which has to live on the tag because it gates storage on the visitor's device, before any request reaches us.