# Account Configuration ### About this export | Field | Value | | --- | --- | | **content_type** | lesson | | **platform** | contentstack-academy | | **source_url** | https://www.contentstack.com/academy/courses/lytics-implementation/account-configuration | | **course_slug** | lytics-implementation | | **lesson_slug** | account-configuration | | **markdown_file_url** | /academy/md/courses/lytics-implementation/account-configuration.md | | **generated_at** | 2026-08-07T05:57:38.711Z | > Part of **[Lytics Implementation](https://www.contentstack.com/academy/courses/lytics-implementation)** on Contentstack Academy. **Academy MD v3** — structured for retrieval; no quiz or assessment keys. #### Lesson text Before you can collect data, build profiles, or activate audiences, you need a properly configured account. That means setting up security policies, creating the right user roles, generating API tokens for your integrations, and installing the SDKs that will send data into the platform. Getting this foundation right prevents problems downstream — misconfigured security leaves your account exposed, missing API tokens block integrations, and an improperly installed tag means no behavioral data flowing in. This module walks you through every step of account setup so you can move into data collection with confidence. ## Account Settings ### Learning Objectives By the end of this section, you will be able to: \- Navigate to the Vault and identify each settings category \- Configure account details including name, domain, and API access \- Apply security policies for login sessions, passwords, and two-factor authentication \- Manage users, assign roles, and control access to PII \- Generate, manage, and revoke API access tokens \- Create and monitor third-party authorizations ### Accessing the Vault The **Vault** — Lytics' centralized account administration area — is where you manage settings, users, security, and SDK setup. You access it by clicking the **Product Switcher** in the top navigation and selecting **Vault**, or by clicking **Account Settings** from the secondary account menu in the bottom-left corner of the UI. The Vault is organized into five top-level sections: Section Path What You Configure **Usage** `/vault/usage` Account quota overview and consumption metrics **Settings** `/vault/settings/...` Account details, JavaScript Tag, API, Content, Security, Data Science, Schema, Company Profile, Audiences **Users** `/vault/users` User accounts, roles, and permissions **Security** `/vault/security/...` Access tokens and third-party authorizations **Setup** `/vault/setup/js` JavaScript Tag installation on your website ![Vault landing page showing the five top-level navigation sections (Usage, Settings, Users, Security, Setup).](https://images.contentstack.io/v3/assets/bltebc53cfaf0dd6403/am706541a37c1fef70/1dae4ba926e6313667d82802/vault_landing_page_five_top.png) ### Account Details Navigate to **Settings > Account Details** (`/vault/settings/details`) to configure your core account information. Field Editable Description **Account Name** Yes Label shown in the account switcher for multi-account users **Domain** Yes Primary domain associated with your account **Contact** Yes Email address of your primary account contact **Allow Access via API** Yes Enables profile data sharing via the Personalization API — required for integrations like Google Analytics that read profile data client-side **Account ID** No Unique identifier used in all API calls (`cid` parameter) **Account Number** No Unique account number for quick reference > Your **Account ID** is the value you pass as `cid` when installing the JavaScript Tag. Copy it from this page when setting up SDKs. ### Settings Categories Beyond Account Details, the **Settings** section contains category-specific configuration pages. Each page controls a distinct area of platform behavior: Category Path Sub-Categories **JavaScript Tag** `/vault/settings/tag` v3 Configuration, Legacy v2 Configuration, Client Side Integrations, Personalization Settings, Data Collection **Lytics API** `/vault/settings/api` API Security, Data Collection, Public API **Content** `/vault/settings/content` Content Topics, Content Enrichment, Content Affinities, Content Recommendations **Security** `/vault/settings/security` Login Sessions, Login Policies **Data Science** `/vault/settings/data_science` EntQL fields, decisioning triggers, scoring streams **Schema** `/vault/settings/schema` Private fields, promoted fields, field hiding **Company Profile** `/vault/settings/onboarding` Company information from onboarding **Audiences** `/vault/settings/audience` Audience similarity enforcement The JavaScript Tag and API settings are covered in detail in the [SDKs](#sdks) section below. The remaining categories are introduced here and covered in depth in their respective academy topics. #### Content Settings Content settings control how Lytics classifies and indexes your web content. Key options include: * **Content topic allowlist / blocklist** — Control which topics appear in your content taxonomy * **Content domains allowlist / blocklist** — Restrict which domains Lytics classifies * **Content paths allowlist / blocklist** — Filter URLs by path substring * **Content created since date** — Only include content after a specified date * **Supported content languages** — Languages permitted during enrichment (empty defaults to English only) * **Observe robots.txt** — Options: `robotstxt`, `meta`, or `none` For more on content classification, see [Content](/academy/courses/lytics-course/content). #### Schema Settings Schema settings control which fields are treated as sensitive and which are surfaced for data science: * **Private fields** — Fields containing PII. These are hidden from users without Admin, Data Manager, or User Search roles. * **Promoted fields** — Fields outside the defaults that you want leveraged in data science modeling and reporting. * **Hide Private Fields** — When enabled, hides PII from exports and segment scans for non-privileged users. > Verify with Lytics Support that field hiding in the segment scan is also enabled for your account to ensure private fields are hidden everywhere. #### Data Science Settings Data Science settings control AI-driven features: * **EntQL Fields** — Fields evaluated via EntQL in the merger before indexing an entity * **Enable Decisioning Triggers** — Auto-trigger Experiences configured for decisioning * **Streams to Allow for Scoring** — Custom streams containing behavioral signals for scoring * **Enable Decisioning Scores** — Enrich profiles with `needs_message` score and `next_event` timestamp per stream ### Security Settings Navigate to **Settings > Security** (`/vault/settings/security`) to configure login and password policies. #### Login Sessions Setting Description **Logon session days** Number of days before forcing re-authentication **Logon session timeout minutes** Minutes of inactivity before forcing re-authentication #### Login Policies Setting Description **Enforce password complexity** Requires minimum 8 characters, at least 1 uppercase (A–Z), 1 lowercase (a–z), 1 digit (0–9), and 1 special character (!@#$&\*) **Enforce password history** Prevents re-use of previous passwords per user **Enforce password bad count** Locks account after too many failed login attempts **Password max age** Maximum days before a password change is required (set to `0` to disable) **Enforce two-factor authentication** Requires 2FA for all account users via Authy SoftToken — users must provide a phone number > Enable 2FA for all production accounts. It adds a second authentication factor (a code that changes every 20 seconds) after the standard password step. ![Security settings page showing login session and login policy configuration options.](https://images.contentstack.io/v3/assets/bltebc53cfaf0dd6403/am356bdc3a05ba9079/f76f83eb19ebff55a5986e8d/security_settings_page_login_session.png) #### Single Sign-On (SSO) Lytics supports SAML-based SSO using Google Cloud Identity Platform as the service provider. SSO is SP-initiated only (IdP-initiated is deprecated). To configure SSO, contact Lytics Support and provide: * **Entity ID** from your identity provider * **Sign In URL** from your identity provider * **X509 Signing Certificate** from your identity provider Lytics provides the **ACS URL**, **Service Provider Entity ID**, and **Sign-in URL** in return. SSO supports role assignment via group names in the format `lytics__` (for example, `lytics_123_admin` or `lytics_123_content_manager`). Lytics has published configuration guides for both Okta and OneLogin. ### User Management Navigate to **Users** (`/vault/users`) to manage who has access to your account. #### Inviting Users 1. Click **Create New** from the user list. 2. Enter the user's email address. 3. Select one or more roles. 4. The user receives an email with a login link. ![Walk through inviting a new user: click Create New, enter email, assign roles, and show the resulting invitation. Then demonstrate editing roles on an existing user.](https://images.contentstack.io/v3/assets/bltebc53cfaf0dd6403/am9f6561352bf55ef7/194853f2e36b1d179e52b1ce/walk_inviting_user_click_create.gif) #### Roles and Permissions Lytics provides granular role-based access control. Each user can be assigned one or more roles: Role Access Level **Admin** Full read/write access to all features and management functions **Data Manager** Read/write access to schemas, queries, users, content, integrations; includes PII access **Audience Manager** Read/write access to audiences **Campaign Manager** Read/write access to campaigns and audiences; no PII, cannot publish campaigns **Content Manager** Read/write access to content classification, collections, topics **Experience Manager** Read/write access to Experiences **Goal Manager** Read/write access to Goals and Experiences **Marketer** Read/write access to audiences and campaigns; no PII **Observer** Read-only access to audiences and campaigns **User Search** Ability to search users and view profiles **Discovery Insights** Access to explore discovery insights > Only users with **Admin**, **Data Manager**, or **User Search** roles can view fields marked as private (PII). Assign roles deliberately to limit PII exposure across your team. #### Managing Your Profile Each user can manage their own profile by navigating to **Manage My User** from the account menu. You can update your name, email, and phone number (required for 2FA). Password changes are self-service — navigate to **Manage My Profile > Change Password**. Changing your password immediately invalidates all current sessions. ### Access Tokens Navigate to **Security > Access Tokens** (`/vault/security/tokens`) to manage API tokens. An access token is a credential that authenticates API requests to Lytics — each token is scoped to specific roles and has a configurable expiration. #### Creating a Token 1. Click **Create New**. 2. Fill in the required fields: Field Required Options **Name** Yes Descriptive label for the token **Description** No Explain the token's purpose and which system uses it **Expiration** Yes 90 days, 30 days, 7 days, or No expiration **Roles** Yes Fine-grained permission selection matching user roles 3. Click **Create**. The token value appears in a one-time dialog. 4. **Copy the token immediately** — you cannot view it again after dismissing the dialog. ![Demonstrate creating an access token: click Create New, fill in name/description/expiration/roles, click Create, and copy the one-time token value.](https://images.contentstack.io/v3/assets/bltebc53cfaf0dd6403/am7bef78007522ae3d/cb28687212ac0abc5d3e1dec/demonstrate_creating_access_token_click.gif) #### Token Best Practices * **Name tokens descriptively** — include the system or integration that uses the token (for example, `segment-export-prod` or `gtm-data-collection`). * **Set expiration dates** — use 90-day or shorter expirations for production tokens and rotate before they expire. * **Use least-privilege roles** — scope each token to only the permissions it needs. * **Store securely** — keep tokens in a secrets manager or environment variable, never in source code. * **Delete unused tokens promptly** — deletion is irreversible and immediately breaks dependent processes, so confirm which systems rely on a token before removing it. #### Managing Tokens The token list is sortable and filterable by name, description, creator, and expiration status. Click any token to view its assigned roles, creation date, and expiration date. ### Authorizations Navigate to **Security > Authorizations** (`/vault/security/authorizations`) to manage credentials for third-party integrations. An authorization is a stored credential that grants Lytics permission to exchange data with a third-party service (email provider, ad platform, data warehouse, etc.). #### Creating an Authorization 1. Click **Create New** to open the authorization wizard. 2. **Choose the provider** — select the third-party tool you are connecting to. 3. **Select the authorization method** — some providers offer a single method, others offer multiple (API key, OAuth, personal/business user tokens). The method you choose determines which job types (real-time vs. bulk) are available. 4. **Add a name, description, and complete the configuration** specific to that provider. ![Walk through creating an authorization: open the wizard, select a provider, choose the authorization method, complete the configuration, and verify health status.](https://images.contentstack.io/v3/assets/bltebc53cfaf0dd6403/am84b1e1ae7ef39120/b3dff2264a5554c12d0bd6b7/walk_creating_authorization_open_wizard.gif) #### Authorization Health Lytics checks authorization status daily and reports one of three states: Status Meaning **Healthy** Authorization is valid and active **Unhealthy** Authorization is invalid or expired — jobs using it will fail **Unknown** Status could not be determined #### Managing Authorizations * **Edit** — You can rename and revise the description, but you cannot change the configuration (credentials). To change credentials, create a new authorization. * **Delete** — You can only delete an authorization if no active jobs (running, sleeping, or paused) reference it. * **Activity Metrics** — For select providers (Facebook, Iterable, Salesforce, SendGrid, and others), you can view request counts on hourly, daily, weekly, and monthly timescales. * **Associated Jobs** — Each authorization's detail page shows a table of all active jobs using it. #### Monitoring and Alerts You can configure alerts on any job or authorization to receive notifications when failures occur. Alert channels include: * **Slack** * **Microsoft Teams** * **Email** Alerts include the latest error message for quick diagnosis. For detailed troubleshooting, use the Job Logs API. ### Platform Limits Lytics enforces limits that affect account configuration decisions. Key limits to keep in mind: Resource Limit Max user profile size 1 MB Max profile identifier size 256 bytes Max user attribute values 1,000 (includes complex field types) Max stitched identifiers per profile 50 Max single event input size 4 KB Max batch record size 16 KB Max total batch size 1 GB Max audiences 500 Max conditions per audience 1,000 Max active import integrations 100 Max active export integrations 200 Max integration creations per hour 10 Max Cloud Connect data models 100 Completed job retention 90 days ### Summary The Vault is the centralized hub for all account administration. Account details (name, domain, API access) and security policies (session timeouts, password complexity, 2FA, SSO) establish your account's baseline configuration. User management follows a role-based access model where each user gets the minimum permissions needed — only Admin, Data Manager, and User Search roles can access PII. Access tokens authenticate API integrations and should be named descriptively, scoped to least-privilege roles, and rotated on a schedule. Authorizations store credentials for third-party services and should be monitored for health status. Platform limits (max audiences, profile size, integration counts) should inform your configuration decisions from the start. ### Documentation Links * [Account Settings](https://docs.lytics.com/docs/account-settings) * [User Management](https://docs.lytics.com/docs/user-management) * [Access Tokens](https://docs.lytics.com/docs/api-tokens) * [Authorizations](https://docs.lytics.com/docs/authorizations) * [Platform Limits](https://docs.lytics.com/docs/platform-limits) ## SDKs ### Learning Objectives By the end of this section, you will be able to: \- Install the Lytics JavaScript Tag on a web property \- Configure the tag with required and optional parameters \- Identify the available mobile SDKs and their configuration patterns \- Verify that the SDK is correctly collecting and transmitting event data \- Use the Chrome DevTools extension for debugging ### JavaScript Tag Installation The JavaScript Tag (jstag) — Lytics' client-side SDK for web properties — is the primary mechanism for collecting behavioral data from your website. It tracks user behavior, resolves identity, surfaces profile data for personalization, and loads the Pathfora SDK for web experiences. Version 3 is the current recommended version. #### Installation Methods **Direct installation** — Copy the tag snippet from **Setup > Website (JS Tag)** (`/vault/setup/js`) in the Vault and paste it into your site's `` section: ```html ``` Replace `YOUR_ACCOUNT_ID` with the Account ID from your **Account Details** page. **Google Tag Manager** — If you use GTM: 1. Log into your GTM account. 2. Click **New Tag > Tag Configuration**. 3. Under Custom, select **Custom HTML**. 4. Paste the Lytics JavaScript Tag snippet. 5. Name the tag `Lytics JavaScript Tag`. 6. Set the trigger to **All Pages**. 7. Click **Save**, then **Submit** to publish. ![Demonstrate both installation methods: direct snippet installation in a site's HTML head, and Google Tag Manager setup with Custom HTML tag and All Pages trigger.](https://images.contentstack.io/v3/assets/bltebc53cfaf0dd6403/ama7505f0b0263439c/64fa60912826345b5a536022/demonstrate_both_installation_methods_direct.gif) #### What the Tag Does When the tag loads on a page, it performs four functions: 1. **Tracks behavior** — Automatically collects page views, referral data, device information, and user language. Each event is sent to the Lytics collection endpoint. 2. **Resolves identity** — Manages the `_uid` cookie to maintain a persistent anonymous identifier across sessions. When you send known identifiers (email, user ID), the tag associates them with the anonymous profile. 3. **Surfaces profile data** — Retrieves the current user's profile from the Personalization API, including audience membership and behavioral scores, making it available client-side for personalization logic. 4. **Loads Pathfora** — When enabled, loads the Pathfora SDK to evaluate and display web Experiences (modals, bars, slideouts) based on audience membership. #### Automatically Collected Fields The tag automatically collects these fields on every event: Field Example Description `_e` `pv` Event type (`pv` = page view) `_ref` `www.lytics.com` Referral domain `_tz` `-7` Timezone offset from UTC `_ul` `en-US` User language `_sz` `2560x1440` Display size `_ts` `1504306728695` Timestamp (milliseconds since epoch) `_nmob` `t` Mobile device indicator `_device` `desktop` Device type `url` `www.example.com/page` Current page URL `_uid` `74481.3222228897` Lytics cookie ID `_v` `3.0.2` JavaScript Tag version ### JavaScript Tag Configuration The `jstag.init()` call accepts a configuration object with required and optional parameters. #### Required Parameters Key Type Description `src` string URL of the tag script: `https://c.lytics.io/api/tag/{YOUR_ACCOUNT_ID}/latest.min.js` > The `cid` (Account ID) is embedded in the `src` URL. You do not need to pass it separately in v3. #### Optional Parameters Key Type Default Description `loadid` boolean `false` Enable cross-domain user identification using third-party cookies `stream` string `getlytics` Name of the data stream for collection `sessecs` integer `1800` Session timeout in seconds — time between requests before a new session starts `qsargs` string\[\] — Array of URL query parameters to capture (e.g., `['utm_source', 'utm_medium']`) `serializer` string `default` Serializer type (`default` or `legacy` for v2 compatibility) `cookies` object — Cookie domain configuration for cross-subdomain tracking #### Custom User Identification When you have an authenticated user, pass their identifier at initialization to link anonymous and known profiles: ```javascript var user = getAuthenticatedUser(); var config = { src: 'https://c.lytics.io/api/tag/YOUR_ACCOUNT_ID/latest.min.js' }; if (user) { config.entity = { byFieldKey: 'custom_uuid', byFieldValue: user.uuid }; } jstag.init(config); ``` #### Sending Custom Events Use `jstag.send()` to send custom event data beyond automatic page views: ```javascript // Send user identity data jstag.send({ email: 'user@example.com', name: 'Jane Doe', company: 'Acme Corp' }); // Send a custom event jstag.send({ event: 'purchase_complete', currency: 'USD', value: 49.99 }); // Send to a specific stream with a callback jstag.send('custom_stream', { action: 'signup' }, function(response) { console.log(response); }); ``` #### Single Page App (SPA) Configuration For single page applications, you need to manually trigger page views and re-fetch the profile on route changes: ```javascript var onRouteChange = function() { // Track route change as a page view jstag.pageView(); // Re-fetch profile and re-evaluate Experiences jstag.loadEntity(function(profile) { console.log(profile.data); }); }; ``` #### Account-Level Tag Settings In addition to the client-side `init()` configuration, you control tag behavior through account settings at **Settings > JavaScript Tag** (`/vault/settings/tag`). These settings are organized into sub-categories: **v3 Configuration** — Core settings for the current tag version: \- **JavaScript Tag TTL** — Cache duration in seconds (lower for testing, higher for production) \- **Enable pageview event on first send** — Automatically adds a `_e: pv` event type on the first `send` call per page load **Client Side Integrations** — Enable or disable automatic data sync with third-party platforms. Configurable integrations include Amazon DSP, Criteo, Google Ads, GA4, DV360, Lotame, Taboola, The Trade Desk, and Yahoo Ads. Additional integrations (AdRoll, Facebook Ads, Google Analytics, GTM, Pathfora, and others) activate automatically. **Personalization Settings** — Control Pathfora and Experiences behavior: \- **Allow Pathfora** — Enable or disable the Pathfora personalization library \- **Allow Event Block** — `0` (off), `1` (active Experiences only), `2` (permanently on) \- **Global Stylesheet URL** — Custom CSS for Lytics-managed Experiences \- **URL Allowlist for Orchestration** — Restrict which URLs evaluate Experiences **Data Collection** — Control how the tag collects incoming data: \- **Custom Cookie Keys** — Cookie names to automatically collect \- **Custom Data Layer** — JavaScript variables to automatically collect \- **Integrations Blocklist** — Prevent specific integrations from syncing ### Mobile SDKs Lytics provides native mobile SDKs for iOS, Android, and React Native. Each SDK follows the same core pattern: initialize with your API token, then use `track`, `identify`, and `consent` methods. #### iOS SDK **Requirements:** iOS 14.0+, Xcode v14.2+ **Installation:** Add the Swift package from `https://github.com/lytics/ios-sdk` via Xcode's **File > Add Packages**. ```swift Lytics.shared.start(apiToken: "YOUR_API_TOKEN") { configuration in configuration.defaultStream = "ios_sdk" configuration.logLevel = .debug configuration.maxQueueSize = 10 configuration.uploadInterval = 10 configuration.sessionDuration = 1200 } ``` #### Android SDK **Requirements:** Android 8+, Android Studio v2021.3.1+ **Installation:** Add the JitPack repository and the dependency `com.github.lytics:android-sdk:`. ```kotlin Lytics.init(applicationContext, LyticsConfiguration( apiKey = "YOUR_API_TOKEN", defaultStream = "android_sdk", logLevel = LogLevel.DEBUG, maxQueueSize = 10 )) ``` #### React Native SDK **Installation:** `yarn add react-native-lytics` ```javascript import { start } from 'react-native-lytics'; start({ apiToken: 'YOUR_API_TOKEN', defaultStream: 'react_native_sdk', logLevel: LogLevel.debug, maxQueueSize: 10 }); ``` #### Common Mobile SDK Configuration Parameters All three mobile SDKs share these configuration options: Parameter Default Description `apiKey` / `apiToken` — Your Lytics API token (required) `defaultStream` SDK-specific Default stream name for events `primaryIdentityKey` `_uid` Strongest identifier key for identity resolution `uploadInterval` `10` seconds How often the SDK flushes queued events `maxQueueSize` `10` Maximum events queued before an automatic flush `sessionDuration` `1200` seconds Inactivity timeout before starting a new session `requireConsent` `false` When `true`, no data is sent until the user opts in `enableSandbox` `false` When `true`, events are validated but not persisted `logLevel` `.error` Logging verbosity (`.error`, `.info`, `.debug`) #### Mobile SDK Core Methods Each SDK provides the same core methods: * **`track`** — Send a custom event with properties * **`identify`** — Associate the current device with a known user identity * **`consent`** — Record proof of user consent with document references * **`optIn` / `optOut`** — Enable or disable data collection (useful for consent management) For detailed mobile SDK documentation, see the Lytics developer documentation. ### Verification and Testing After installing any SDK, verify that it is working correctly. #### Browser Console Verification (JavaScript Tag) Open your browser's developer console on a page where the tag is installed and run these checks: ```javascript // Check that the tag is loaded jstag.isLoaded // Expected: true // Check the tag version jstag.config.version // Expected: "3.x.x" // Check audience membership jstag.getSegments() // Expected: array of audience slugs // Get the anonymous ID jstag.getid(function(id) { console.log(id); }); // Expected: Lytics _uid value ``` #### Network Verification 1. Open **Developer Tools > Network** tab. 2. Filter requests for `lytics.io`. 3. Look for requests to the `/c` endpoint (data collection) — these confirm events are being sent. 4. Look for requests to the `/personalize` endpoint — these confirm profile data is being retrieved. #### Entity Ready Callback To verify that the full profile (including audience membership and Experiences) is being returned: ```javascript jstag.call('entityReady', function(profile) { console.log('Audiences:', profile.data.user.segments); console.log('Experiences:', profile.data.experiences); }); ``` #### Testing Best Practices * **Use incognito mode** — This clears cookies and caches, giving you a clean anonymous user for each test. * **Document test results** — Record the date, time, and results of each verification check. * **For known users** — Use unique test email addresses. You can leverage email punctuation (e.g., `test+1@example.com`) to create distinct identities. * **For anonymous users** — Retrieve the cookie ID with `jstag.getid(id => console.log(id))` to look up the test profile in the Lytics UI. #### Chrome DevTools Extension Install the **Lytics Dev Tools Extension** from the Chrome Web Store for a visual debugging experience. The extension provides four tabs: Tab What It Shows **Status** Real-time SDK installation and operational status **Debugger** Active configuration, live event monitoring, installation validation **Profile** Current visitor's profile: behavioral scores, custom attributes, audience membership **Personalization** Log of active Lytics Experiences and campaigns evaluated for this visitor ![Lytics Dev Tools Chrome extension side panel showing the Status tab: JavaScript SDK version, Account ID, stream, cookie name, profile key, and last-activity indicator confirming a healthy tag install.](https://images.contentstack.io/v3/assets/bltebc53cfaf0dd6403/amb3dfba931b26e21d/36a91aac9550bfbd2a94f376/demonstrate_verifying_javascript_tag_installation.png) #### Hosting the Tag Locally (Advanced) In strict security compliance or air-gapped environments, you can host the tag on your own infrastructure: 1. Navigate to **Setup > Website (JS Tag)** and copy the `src` URL. 2. Open the URL in a browser and save the file. 3. Host the file on your web server. 4. Update the `src` parameter in `jstag.init()` to point to your hosted copy. > Hosting the tag locally voids SLAs, requires manual updates for bug fixes, and disables dynamic account settings. Only use this approach when required by compliance. #### Subresource Integrity (SRI) For environments that require SRI verification, you can host the tag files yourself and add integrity attributes. The four files you need to host and verify are: 1. **Core Tag** — `//c.lytics.io/api/tag/{ACCOUNT_ID}/latest.min.js` 2. **Pathfora JS** — `//c.lytics.io/static/pathfora.min.js` 3. **Pathfora CSS** — `//c.lytics.io/static/pathfora.min.css` 4. **Experience Config** — `//c.lytics.io/api/experience/candidate/{ACCOUNT_ID}/config.js` ### Summary The JavaScript Tag (v3) is the primary data collection mechanism for web properties — it tracks behavior, resolves identity, retrieves profile data for personalization, and loads Pathfora for web experiences. Installation is either direct (paste the snippet) or via Google Tag Manager. Account-level tag settings in the Vault control caching, client-side integrations, personalization behavior, and data collection parameters. For mobile apps, native SDKs for iOS, Android, and React Native follow the same pattern: initialize with an API token, then use `track`, `identify`, and `consent` methods. Always verify installation using browser console commands, network inspection, and the Lytics Dev Tools Chrome extension. ### Documentation Links * [JavaScript Tag Overview](https://docs.lytics.com/docs/javascript-tag) * [JavaScript Tag Configuration](https://docs.lytics.com/docs/jstag-configuration) * [iOS SDK](https://docs.lytics.com/docs/sdk-ios) * [Android SDK](https://docs.lytics.com/docs/sdk-android) * [React Native SDK](https://docs.lytics.com/docs/sdk-react-native) * [Chrome DevTools Extension](https://docs.lytics.com/docs/chrome-extension) ## What You've Learned You now know how to configure a Lytics account from scratch. You've walked through the Vault's five top-level areas — Usage, Settings, Users, Security, and Setup — and understand how to configure account details, enforce security policies, manage users with role-based access, create and rotate API tokens, and set up third-party authorizations. You've also installed and configured the JavaScript Tag for web data collection, learned the available mobile SDKs and their shared configuration patterns, and verified that data is flowing correctly using console commands, network inspection, and the Chrome DevTools extension. ### Key Terms > 📘 **Vault** — The centralized account administration area in Lytics where you manage settings, users, security, and SDK setup. > > 📘 **Access Token** — A credential used to authenticate API requests to Lytics. Each token is scoped to specific roles and has a configurable expiration. > > 📘 **Authorization** — A stored credential that grants Lytics permission to exchange data with a third-party service (email provider, ad platform, data warehouse, etc.). > > 📘 **JavaScript Tag (jstag)** — The Lytics client-side SDK for web properties. It tracks user behavior, resolves identity, surfaces profile data for personalization, and loads the Pathfora SDK for web experiences. > > 📘 **Account ID** — The unique identifier for your Lytics account, passed as the `cid` parameter in API calls and embedded in the JavaScript Tag's `src` URL. > > 📘 **Personalization API** — The client-side API that returns the current user's profile data, including audience membership and behavioral scores, for use in personalization logic. > > 📘 **Pathfora** — The Lytics web personalization SDK that evaluates and displays Experiences (modals, bars, slideouts) based on audience membership. **Next step:** Proceed to [Data Flow](/academy/courses/lytics-course/data-flow) to understand how data moves through the platform's collection and processing pipeline. #### Key takeaways - Connect **Account Configuration** back to your stack configuration before moving to the next module. - Capture one concrete artifact (screenshot, Postman call, or code snippet) that proves the step works in your environment. - Re-read the delivery versus management boundary for anything you changed in the entry model. ## Supplement for indexing ### Content summary Account Configuration. Before you can collect data, build profiles, or activate audiences, you need a properly configured account. That means setting up security policies, creating the right user roles, generating API tokens for your integrations, and installing the SDKs that will send data into the platform. Getting this foundation right prevents problems downstream — misconfigured security leaves your account exposed, missing API tokens block integrations, and an improperly installed tag means no behavioral data flowing in. This module walks you through every step of account setup so you can move into data collection with confidence. Account Settings Learning Objectives By the end of this section, you will be ab ### Retrieval tags - Account - Configuration - lytics-implementation - lesson 02 - Account Configuration - lytics-implementation lesson ### Indexing notes Index this lesson as a primary chunk tagged with lesson_id "02" and topics: [Account, Configuration]. Parent course slug: lytics-implementation. Use asset_references URLs as thumbnail hints in search results when present. Never surface LMS quiz content or assessment answers from this file. ### Asset references | Label | URL | | --- | --- | | Vault landing page showing the five top-level navigation sections (Usage, Settings, Users, Security, Setup). | `https://images.contentstack.io/v3/assets/bltebc53cfaf0dd6403/am706541a37c1fef70/1dae4ba926e6313667d82802/vault_landing_page_five_top.png` | | Security settings page showing login session and login policy configuration options. | `https://images.contentstack.io/v3/assets/bltebc53cfaf0dd6403/am356bdc3a05ba9079/f76f83eb19ebff55a5986e8d/security_settings_page_login_session.png` | | Walk through inviting a new user: click Create New, enter email, assign roles, and show the resulting invitation. Then demonstrate editing roles on an existing | `https://images.contentstack.io/v3/assets/bltebc53cfaf0dd6403/am9f6561352bf55ef7/194853f2e36b1d179e52b1ce/walk_inviting_user_click_create.gif` | | Demonstrate creating an access token: click Create New, fill in name/description/expiration/roles, click Create, and copy the one-time token value. | `https://images.contentstack.io/v3/assets/bltebc53cfaf0dd6403/am7bef78007522ae3d/cb28687212ac0abc5d3e1dec/demonstrate_creating_access_token_click.gif` | | Walk through creating an authorization: open the wizard, select a provider, choose the authorization method, complete the configuration, and verify health statu | `https://images.contentstack.io/v3/assets/bltebc53cfaf0dd6403/am84b1e1ae7ef39120/b3dff2264a5554c12d0bd6b7/walk_creating_authorization_open_wizard.gif` | | Demonstrate both installation methods: direct snippet installation in a site's HTML head, and Google Tag Manager setup with Custom HTML tag and All Pages trigge | `https://images.contentstack.io/v3/assets/bltebc53cfaf0dd6403/ama7505f0b0263439c/64fa60912826345b5a536022/demonstrate_both_installation_methods_direct.gif` | | Lytics Dev Tools Chrome extension side panel showing the Status tab: JavaScript SDK version, Account ID, stream, cookie name, profile key, and last-activity ind | `https://images.contentstack.io/v3/assets/bltebc53cfaf0dd6403/amb3dfba931b26e21d/36a91aac9550bfbd2a94f376/demonstrate_verifying_javascript_tag_installation.png` | ### External links | Label | URL | | --- | --- | | Contentstack Academy home | `https://www.contentstack.com/academy/` | | Training instance setup | `https://www.contentstack.com/academy/training-instance` | | Academy playground (GitHub) | `https://github.com/contentstack/contentstack-academy-playground` | | Contentstack documentation | `https://www.contentstack.com/docs/` | | Vault landing page showing the five top-level navigation sections (Usage, Settings, Users, Security, Setup). | `https://images.contentstack.io/v3/assets/bltebc53cfaf0dd6403/am706541a37c1fef70/1dae4ba926e6313667d82802/vault_landing_page_five_top.png` | | Security settings page showing login session and login policy configuration options. | `https://images.contentstack.io/v3/assets/bltebc53cfaf0dd6403/am356bdc3a05ba9079/f76f83eb19ebff55a5986e8d/security_settings_page_login_session.png` | | Walk through inviting a new user: click Create New, enter email, assign roles, and show the resulting invitation. Then demonstrate editing roles on an existing | `https://images.contentstack.io/v3/assets/bltebc53cfaf0dd6403/am9f6561352bf55ef7/194853f2e36b1d179e52b1ce/walk_inviting_user_click_create.gif` | | Demonstrate creating an access token: click Create New, fill in name/description/expiration/roles, click Create, and copy the one-time token value. | `https://images.contentstack.io/v3/assets/bltebc53cfaf0dd6403/am7bef78007522ae3d/cb28687212ac0abc5d3e1dec/demonstrate_creating_access_token_click.gif` | | Walk through creating an authorization: open the wizard, select a provider, choose the authorization method, complete the configuration, and verify health statu | `https://images.contentstack.io/v3/assets/bltebc53cfaf0dd6403/am84b1e1ae7ef39120/b3dff2264a5554c12d0bd6b7/walk_creating_authorization_open_wizard.gif` | | Account Settings | `https://docs.lytics.com/docs/account-settings` | | User Management | `https://docs.lytics.com/docs/user-management` | | Access Tokens | `https://docs.lytics.com/docs/api-tokens` | | Authorizations | `https://docs.lytics.com/docs/authorizations` | | Platform Limits | `https://docs.lytics.com/docs/platform-limits` | | Demonstrate both installation methods: direct snippet installation in a site's HTML head, and Google Tag Manager setup with Custom HTML tag and All Pages trigge | `https://images.contentstack.io/v3/assets/bltebc53cfaf0dd6403/ama7505f0b0263439c/64fa60912826345b5a536022/demonstrate_both_installation_methods_direct.gif` | | Lytics Dev Tools Chrome extension side panel showing the Status tab: JavaScript SDK version, Account ID, stream, cookie name, profile key, and last-activity ind | `https://images.contentstack.io/v3/assets/bltebc53cfaf0dd6403/amb3dfba931b26e21d/36a91aac9550bfbd2a94f376/demonstrate_verifying_javascript_tag_installation.png` | | JavaScript Tag Overview | `https://docs.lytics.com/docs/javascript-tag` | | JavaScript Tag Configuration | `https://docs.lytics.com/docs/jstag-configuration` | | iOS SDK | `https://docs.lytics.com/docs/sdk-ios` | | Android SDK | `https://docs.lytics.com/docs/sdk-android` |