Tugus Docs

Manual Installation

Add the Tugus script to the <head> of your site — directly or first-party via your own CNAME.

Add the following snippet as early as possible to the <head> of your page. You find your API key in the dashboard under Settings → Websites → your website → Script.

<!-- Tugus script — as early as possible in the <head> -->
<script
  src="https://collect.tugus.io/v1/tg.min.js"
  data-key="tg_YOUR_API_KEY"
  async
></script>

data-key is your property-specific API key. Every property in the dashboard has its own key. Never share it publicly — the key is not secret, but it is bound to your property.

Serve all Tugus requests through your own subdomain (e.g. metrics.yourshop.com) instead of collect.tugus.io. This is the single most important step for reliable tracking — not a nice-to-have. Without it, a large and growing share of your events, cookies and conversions is silently lost before it ever reaches a platform.

Why you need it

Modern browsers and ad blockers actively degrade tracking that runs in a third-party context — i.e. from a domain different to the one in the address bar. When Tugus is loaded from collect.tugus.io on yourshop.com, that is exactly the third-party context they target. A CNAME turns the same requests into first-party traffic on your own domain, which changes the outcome completely:

  • Safari & Firefox tracking prevention (ITP/ETP). Safari's Intelligent Tracking Prevention caps cookies set by third-party scripts to 7 days — or as little as 24 hours when the visitor arrives from an ad click with link decoration. Returning customers and longer conversion windows simply fall out of your data. First-party cookies set server-side via a CNAME are not subject to this cap.
  • Longer, stable identifiers. Because Tugus sets the cookie server-side as HttpOnly first-party, it survives up to 2 years instead of days. That keeps client_id stable across sessions and devices — the basis for attribution, funnels and returning-visitor recognition.
  • Ad & content blockers. Many blocklists work by domain name and block known endpoints like collect.tugus.io outright. Requests to your own metrics.yourshop.com are not on those lists, so a significant share of otherwise-blocked events gets through.
  • Better match quality for conversion APIs. More surviving events, stable IDs and preserved first-party cookies mean higher match rates and more complete conversion data at Meta CAPI, Google Ads, GA4 and TikTok — which directly affects how well their algorithms optimise your campaigns.
  • Lower data loss overall. Every effect above compounds: you measure a larger, more representative share of real traffic instead of a shrinking, browser-filtered subset.

Without a CNAME, expect meaningful under-reporting — especially on Safari/iOS traffic and from visitors using ad blockers. The events you lose are gone for good; they cannot be recovered later. Set this up before you rely on the numbers for decisions.

DNS configuration

# Add to your nameserver:
metrics.yourshop.com.  CNAME  collect.tugus.io.
  1. Set the CNAME recordmetrics.yourshop.com → collect.tugus.io
  2. Verify in the dashboard — Settings → Websites → your website → First-Party → enter your domain → verify. SSL via Let's Encrypt is set up automatically.
  3. Update the script URL — point the script tag at your own subdomain:
<!-- With CNAME: script served from your own domain -->
<script
  src="https://metrics.yourshop.com/v1/tg.min.js"
  data-key="tg_YOUR_API_KEY"
  async
></script>