> ## Documentation Index > Fetch the complete documentation index at: https://docs.clickbase.so/llms.txt > Use this file to discover all available pages before exploring further. # Install the script > The Clickbase widget is a single, tiny ``` | Attribute | Required | Description | | -------------- | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | | `data-site-id` | Yes | Your site's **tracking key** — a UUID. This is the same value the config endpoint is keyed by, and it identifies which property the hits belong to. | | `data-domain` | Recommended | The site's domain (e.g. `example.com`). Used as the shared cookie domain in cookie mode so a visitor is recognized across subdomains. | | `src` | Yes | The widget script URL. Always `https://cdn.clickbase.so/t.js`. | | `defer` | — | Recommended, so the script never blocks rendering. | Your tracking key and the exact snippet are shown on the site's **install** screen in the dashboard — copy it from there so the values are filled in for you. A handful of optional `data-*` attributes tune advanced behavior (manual mode, path filtering, download extensions, event tagging) — see [Configuration](/widget/configuration#install-time-data-attributes). ## What loads at runtime Beyond those install-time attributes, every behavior toggle — tracking mode, which autocapture events fire, whether Web Vitals / error tracking / session replay are on — is fetched once from your site's remote configuration (`GET /api/tracking-config/{trackingKey}`) before the first pageview. Change those toggles in your dashboard and every visitor picks them up without touching the tag. See [Configuration](/widget/configuration). ## Single-page apps The script tracks history navigations automatically — no extra setup for SPAs. See [Pageviews & SPAs](/widget/pageviews) for what counts as a pageview and how URL parameters are handled. ## Content Security Policy If your site sends a `Content-Security-Policy` header, allow the widget to load and to send its hits: * `script-src https://cdn.clickbase.so` * `connect-src https://clickbase.so` ## Verify it's working Once the snippet is live, open your site and then watch the site's **Realtime** view in Clickbase — your own visit should appear within a few seconds. If nothing shows up, confirm the `data-site-id` matches your site's tracking key and that no CSP or ad blocker is stripping `cdn.clickbase.so`.