Skip to main content
Your tracking key lives on Settings → Web Tracking, alongside Rotate and Revoke.

​
First: the key isn’t a secret

It sits in the data-ag-key attribute of every page carrying your tag, so anyone viewing your page source can read it. It says which allGood account is sending; it doesn’t authorise the sender. What actually controls who can send into your account is the allowed origins list, plus bot protection for anything that isn’t a browser. Somebody holding your key can only post from a website you’ve already allowed, and can only make traffic look like yours. That’s worth knowing before you treat a leaked key as an emergency. Rotate anyway if you’d rather — but rotating has a cost, below.

​
Rotate

Rotate issues a new key and stores it. The old key keeps working until the new one has reached allGood’s edge, so a rotation never leaves a window where neither key is valid and traffic goes missing.
Rotating changes the value in your tag. Every page carrying the old key, and every Google Tag Manager container, has to be updated with the new one — otherwise those pages stop being recorded once the old key stops working.
Do it in this order:
1

Rotate the key

On Settings → Web Tracking, click Rotate. The new key appears immediately.
2

Update every page and container

Copy the new tag and replace it everywhere — your site’s <head>, and any GTM container using the generated template.
3

Confirm events are still arriving

Load a page and check the browser’s network tab for a successful tracking request. See Troubleshooting if it’s refused.

​
Revoke

Revoke clears the key. Every tracked event is then refused until you issue a new one, and the screen shows a revoked badge. Use it when you want tracking to stop now, rather than when you want a different key.
Revoking does not stop form capture. Forms are identified by their own public id and gated by the allowed origins list; they don’t use the tracking key at all. To stop a form accepting submissions, unregister the form.

​
The keyId

Next to the key, allGood shows a short keyId — a fingerprint of the key in force. Quote that to support when you need to say which key is live, rather than pasting the key itself.

Set up web tracking

Issuing a key and installing the tag for the first time.

Troubleshooting

What a refused tracking request looks like, and why.