> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Embedded Web SDK API

> Public web-SDK endpoints (/sdk/*) — identify, track, personalize. Authenticated by tenant public key (dv_live_pk_*); deliberately outside /api/v1 so customer embeds don't version-pin.

# Embedded Web SDK API

The endpoints that the [`@devotel/orbit-web-sdk`](/sdks/node) (browser-side) hits at runtime. Mounted at `/sdk/*` (no `/api/v1` prefix) so customer-side embeds don't have to think about API versions.

**Base path:** `https://api.orbit.devotel.io/sdk` (no `/api` prefix)

**Authentication:** Tenant **public** key (`dv_live_pk_*`) sent in the `X-API-Key` header. These endpoints accept the live-mode public key only. CORS is wide open — these endpoints are designed to be hit directly from the customer's website JavaScript.

**Why a separate base path:** server-to-server keys (`dv_live_sk_*`) are secret. Browser-embedded public keys (`dv_live_pk_*`) are safe to ship in client-side code. The split base prevents accidentally exposing a server key in a browser bundle.

## Identify

Resolve an anonymous browser visitor to a known contact (by email or phone) so subsequent events attach to the right contact record.

```js theme={null}
fetch('https://api.orbit.devotel.io/sdk/identify', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json', 'X-API-Key': 'dv_live_pk_your_key' },
  body: JSON.stringify({
    anonymous_id: 'anon_8f3c2b1d',
    email: 'jane@example.com',
    display_name: 'Jane Doe'
  })
});
```

`anonymous_id` is required (it ties the call back to the browser session). Include at least one of `email` or `phone` to resolve the contact; `display_name` and `traits` are optional.

| Method | Path            | Purpose                                   |
| ------ | --------------- | ----------------------------------------- |
| `POST` | `/sdk/identify` | Resolve / merge anonymous → known contact |

## Track

Capture a custom event (page view, button click, video watched, item added to cart). Events flow into the same `sdk_events` store that powers segmentation, scoring, and contact timelines.

```js theme={null}
fetch('https://api.orbit.devotel.io/sdk/track', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json', 'X-API-Key': 'dv_live_pk_your_key' },
  body: JSON.stringify({
    anonymous_id: 'anon_8f3c2b1d',
    events: [
      { name: 'item_added_to_cart', properties: { sku: 'shoe-42', value: 89.99 } }
    ]
  })
});
```

Send up to 50 events per call. Each event needs a `name`; `properties` and an ISO-8601 `timestamp` are optional. The required `anonymous_id` identifies the browser session, so events captured before a visitor identifies still attach to the right contact.

| Method | Path         | Purpose                           |
| ------ | ------------ | --------------------------------- |
| `POST` | `/sdk/track` | Capture one or more custom events |

## Personalize

Fetch the right [personalization slot](/api-reference/personalization) variant for the current visitor at runtime.

```js theme={null}
const res = await fetch(
  'https://api.orbit.devotel.io/sdk/personalize?slot=hero_banner',
  { headers: { 'X-API-Key': 'dv_live_pk_your_key' } }
);
const { data: { content } } = await res.json();
```

| Method | Path               | Purpose                                                |
| ------ | ------------------ | ------------------------------------------------------ |
| `GET`  | `/sdk/personalize` | Resolve a personalization slot for the calling visitor |

## See also

* [Personalization API](/api-reference/personalization) — the dashboard side that defines slots
* [Web SDK reference](/sdks/node) — the JS package wrapping these endpoints