# Script tag reference

> Every data-* attribute the tracker reads, their defaults, and which settings live in the dashboard instead of the snippet.

Section: Tracking. Canonical page: https://mrkr.app/docs/tracking/script-reference. Last updated: 2026-09-02.

The script tag has six attributes it reads, plus one retired attribute it ignores. Everything else about how a site is tracked lives in your dashboard settings, not in the tag.

## Attributes

- `data-site` (required): Your site id. Without it, the tracker logs a console warning and does nothing else: no requests are sent.
- `data-cookies` (opt-in, default: absent): The only value that means anything is `on`, which puts the tracker into cookie mode and lets it store a first-party `_pw_id` identifier for a year. Absent means cookieless, which means no cookie is written or read at all, and absent is the default, so a snippet without this attribute never stores anything persistent on a visitor's device. Your install snippet only carries it when the site's tracking mode is set to cookie-based in dashboard settings, so cookieless sites need no consent banner for it.
- `data-endpoint` (default: script origin + /api/collect): Overrides where events are POSTed. By default the tracker sends to `/api/collect` on whichever origin served `tracker.js` itself (not the page's own origin), so a script loaded from `mrkr.app` and embedded on your site still reaches mrkr rather than 404ing against your own domain.
- `data-replay-endpoint` (default: script origin + /api/replay): Overrides where session-replay batches are sent. Only relevant when replay is enabled for the site.
- `data-mask-input` (default: 1): Controls session-replay input masking. `1` (the default) masks every form input's value in recordings. Set to `0` to record typed values in ordinary text fields. Password and email inputs stay masked either way, regardless of this setting.
- `data-debug` (default: 0): Set to `1` to log the tracker's requests and the server's responses to the console, prefixed `[mrkr]`. See [Verify your install](https://mrkr.app/docs/get-started/verify).
- `data-autocapture` (no longer used): Retired in September 2026, when click autocapture was removed outright. The attribute is ignored and can be deleted from your snippet. See [What mrkr records automatically](https://mrkr.app/docs/tracking/autocapture).

## What's controlled from the dashboard instead

A few settings deliberately don't live on the snippet at all:

- **Tracking mode** (cookieless vs. cookie-based): /dashboard/settings, with the single exception of `data-cookies` above. The server reads your mode from your site's row, but the decision to *store* a cookie happens in the browser before any request is made, so a cookie-mode site carries that one attribute on the tag.
- **Session replay** (on/off, and sample rate): /dashboard/settings
- **Excluded paths**: /dashboard/settings

These are stored against your site's row in the database and read fresh on every request that hits the collect endpoint. Flip a toggle in the dashboard and it takes effect on the very next event: nobody has to re-paste the snippet, redeploy, or wait for a cache to expire. That's also why the tag barely changes shape based on your settings: the same `<script>` tag works whether replay is on or off. The one exception is `data-cookies`, which has to live on the tag because it gates storage on the visitor's device, before any request reaches us.