Set up Visitor Fast

Add your website in the workspace and copy its script. Paste it before </head> on every page and deploy. The site switches to “Receiving data” after its first real pageview.

<script defer src="https://visitorfast.com/js/script.js" data-site="YOUR_SITE_KEY"></script>

• Single-page apps are tracked automatically on route changes.
• The registered domain, its www alias and subdomains are accepted; add other domains in Settings.
• With a Content Security Policy, allow https://visitorfast.com in both script-src and connect-src.

Send an event after something meaningful succeeds. Turn it into a goal in Settings to see its conversion rate.

window.vast.track("signup_completed", { plan: "growth" });
window.vast.identify("user_123", { name: "Ada" });

Revenue is only ever recorded from a trusted server, never from the browser. Each payment is credited to the first-touch source, campaign and landing page of the visitor who paid. There are three ways to send it:

1. Connect your provider (recommended). In Settings → Revenue, choose Stripe, Dodo Payments, Lemon Squeezy, Paddle, Polar, Shopify or WooCommerce and paste the webhook signing secret (plus a restricted read-only API key for Stripe and Dodo). You get a webhook URL to add in the provider's dashboard. Secrets are encrypted at rest.
2. Pass the visitor ID at checkout. Read window.vast.visitorId on the page, send it to your server, and put it in the checkout metadata as vast_visitor_id. For Stripe subscriptions, also set it on subscription_data.metadata so renewals are attributed.
3. Or use the API from your backend after verifying your provider's webhook: POST /api/v1?resource=payments with a payments token (see below).

// Stripe: create the Checkout Session on your server
await stripe.checkout.sessions.create({
  mode: "payment",
  line_items: [{ price: "price_123", quantity: 1 }],
  metadata: { vast_visitor_id: visitorIdFromThePage },
  success_url: "https://example.com/thanks",
});

Refunds sent by the same webhook reduce the attributed revenue. Currencies are kept separate.

Create a website-scoped token in Settings → API access tokens. Tokens are hashed at rest, expire after 90 days and are shown once. Give each token only the permissions it needs: read, events, payments or manage.

curl "https://visitorfast.com/api/v1?resource=overview&since=2026-10-01T00:00:00Z" \
  -H "Authorization: Bearer vast_…"

• GET resource= overview, visitors, events, payments, bots, settings, goals, funnels, notes, segments, alerts or keywords. Lists return 100 rows per page; since defaults to 24 hours ago.
• Overview includes revenue_minor: revenue per currency in minor units (cents).
• POST resource=events with id, visitorId, sessionId, event, path, properties sends a server-side event (events token).
• POST resource=payments with id, visitorId, amount, currency, at records a verified payment (payments token). The visitor must already exist on the website.
• POST resource=refunds with id, paymentId, amount records a refund.
• IDs are deduplicated, so retries are safe. Errors return JSON with an error message and a 4xx status.

curl -X POST "https://visitorfast.com/api/v1?resource=payments" \
  -H "Authorization: Bearer vast_…" -H "content-type: application/json" \
  -d '{"id":"order_123","visitorId":"…","amount":4900,"currency":"USD","at":"2026-10-14T10:00:00Z"}'

Set VAST_URL and VAST_TOKEN, then run node scripts/vast-cli.mjs help from the repository. Every command prints JSON and exits non-zero on API errors.

• data-clicks="true" records click positions for the heatmap.
• data-hash="true", data-scroll="true", data-outbound="true" track hash routes, scroll depth and outbound links.
• data-storage="none" keeps the visitor ID in memory only.
• data-cookie-domain and data-domains keep one visitor across subdomains and allowed domains.

New accounts get a 7-day free trial. Plans are priced by monthly events. Above your allowance, collection continues and reports ask you to upgrade; nothing is lost. See pricing.