Web
Add Vouch to a web app. Attribution is exact here, because there is no store to lose the click in.
The shortest of these quickstarts, because the web has no store hop to work around. A Vouch link redirects straight to your page carrying a single-use token, and the SDK hands it back.
Allow your origin
Nothing works from a browser until you say which sites may use the key. Settings → your app → Web origins, then add each one exactly as a browser sends it.
https://acme.com
https://www.acme.comBoth, if you serve both: matching is exact on scheme, host and port, with no wildcards and no subdomain matching. A wildcard would admit anything anybody can get a subdomain on.
Until an origin is listed every request is refused with a 403 saying so, which is deliberate: a publishable key is readable by anybody who opens the network tab, and unlike a mobile build there is no attestation behind it.
Install and initialise
npm install @vouch/webimport { Vouch } from "@vouch/web";
await Vouch.init({ key: "pk_live_…", appId: "app_…" });That is attribution done. The SDK reads the token from the URL, redeems it, and takes it back out of the address bar so a visitor who copies the link does not hand somebody a spent one.
Identify and record
await Vouch.identify("user_42");
Vouch.track("checkout.started", { plan: "pro" });identify is what lets referrals and segments find this browser. Events
batch for a second and go together, and whatever is queued leaves when the
page is hidden.
Conversions are not here: post them from your own backend with a secret key, because a page that could record revenue could invent it.
Check it worked
Open one of your links on a desktop browser. Vouch.match should come back
as session with the link it came from, and the device appears in the
dashboard as a web device within seconds.
const match = await Vouch.init({ key: "pk_live_…", appId: "app_…" });
console.log(match); // { type: "session", link_id: "lnk_…", destination: "/summer" }A session match is exact. If you ever see probabilistic on the web,
something is wrong: the server refuses to guess for browsers.
Next
The web documentation covers web push, what the SDK stores, and the one thing the web cannot do, which is attest that a device is real.