Conversion Tracking

Integration guide for developers

When a visitor completes a sale, signup, or form submission, report it to ClickLens. The engine scores the conversion as its own event, with the same scrutiny it gives the click, then decides whether it is genuine. A conversion is positive evidence of a human, but it never overrides the engine's own judgement: a session the engine scored as a bot cannot whitewash itself into your ground truth by converting.

Already installed the tag? You report a conversion with one call. The same tag handles it, so there is no second snippet. If you have not installed yet, start with the install guide.

Report a conversion

Call clicklens('conversion', …) when the conversion fires — on your thank-you page, or in the success handler of an in-page form.

clicklens('conversion', { type: 'lead', value: 49, currency: 'USD' });

Call it whenever you like, including before the tag has finished loading. The install snippet opens with a one-line queue that catches early calls and hands them to the tag when it arrives, which is what makes a thank-you page that converts on load work at all. If you installed before August 2026 your snippet is missing that line — recopy it from Settings → Site Settings in the dashboard.

Options

Option Type Notes
type string One of lead, purchase, add_to_cart, signup, or custom. Anything else is recorded as custom. Defaults to custom when omitted.
value number The conversion's value. Used to restate value on a down-weight. Non-numeric values are ignored.
currency string ISO currency code for value, for example USD.
orderId string Your transaction id for this conversion: the same value your Google tag sends as its transaction id. Google finds a conversion to retract by this id, so without it ClickLens can't retract the conversion on Google. Up to 128 characters.

All four options are optional — clicklens('conversion') on its own records a custom conversion. The call sends a signed conversion beacon and returns immediately; it is fire-and-forget, with nothing to await. The beacon also captures the page URL so the click-id (gclid, fbclid, and similar) is recorded for reconciliation, even on a session that never stitched.

Form capture

Form capture reports a conversion when a visitor submits a lead form, with no code on your side. The install snippet the dashboard gives you has it on: the tag carries data-cl-auto-convert="true". Remove the attribute, or switch off “Capture form submits” before copying the snippet, to turn it off. When the tag reads its config from window.__clicklens, set autoConversion: true. A tag installed without either does not capture forms.

<script defer src="https://app.clicklens.io/t.js" data-site="YOUR_SITE_KEY" data-cl-auto-convert="true"></script>

A form with fields to fill in is reported as a lead. A form whose only field is an email address is a signup. These forms report nothing:

  • search forms: role="search", an <input type="search">, or a single field named q, s, query, search or keyword;
  • any form with a password field, such as a login;
  • a form with data-cl-ignore, or inside an element with it;
  • a novalidate form that fails the browser's own field rules, such as an empty required field.

Each form reports at most once per page view. If the form's success handler also calls clicklens('conversion', …) within 2 seconds of the submit, that call replaces the automatic one, so the lead is counted once and carries your type and value.

Form capture cannot see a form inside another company's frame, such as an embedded HubSpot form or a Calendly booking, or a form your script sends without a submit event. Call clicklens('conversion') from the success handler for those. The Google Tag Manager template, the WordPress plugin and the Shopify app cannot turn form capture on yet; on those installs, use the call or paste the snippet by hand.

What the conversion beacon records

The conversion beacon snapshots the meta-timing and structure of how the conversion came to exist — the provenance of the submit. These seven signals fall into three families:

Family Signal What it captures
Gesture authenticity submitWasTrusted Whether the submit carried the browser's trusted-event flag, set only by a real user action and never by a scripted submit.
hadPrecedingPointerPath Whether the pointer moved on the page before the conversion fired.
pasteWithoutFocusCount How many fields were filled by a paste that never followed a focus — a scripted-autofill tell.
Fill pattern keystrokeFieldCount How many distinct fields received keystrokes.
fieldFillOrderEntropy The entropy of the order in which fields were filled. A bot tends to fill in a rigid, low-entropy order.
interactionCount The total number of field interactions recorded.
Timing msFromLoadToConversion Milliseconds from page load to the conversion. A sub-second form fill is not a human typing.

No personal data leaves the page. The beacon records the timing and structure of the submit, never field values, never what was typed, never an email or a name.

How the conversion is judged

ClickLens combines three things: the session's stored humanness score, the submit provenance above, and the coherence of the journey that led to the conversion. The result is a graded verdict — pass, down-weight, or retract. Retraction carries the highest bar, because removing a real conversion is the costliest error. The conversion is recorded either way, so a click-id-keyed adjustment can be attempted later.

Acting on those verdicts — restating or retracting a conversion on your ad platform — is in measured rollout: today the dashboard shows the adjustment ClickLens would make before any gate changes data on real traffic. The conversion protection guide covers how a conversion is graded, what write-back does on each platform, and the holdout that measures the lift; the feature page sets out the full mechanism.

Server-side fallback

When you cannot run the tag at the moment of conversion — a purchase confirmed by a Stripe webhook, say — report it from your backend with POST /api/v1/sessions/convert. Pass the session key the tag stored in sessionStorage under cl_sk; read it on the frontend and hand it to your server.

This path carries the session key only, with none of the submit provenance above, so it is a weaker signal than the clicklens('conversion') call. Use the tag call when you can, and this when you cannot.

Node.js

await fetch('https://app.clicklens.io/api/v1/sessions/convert', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Authorization': 'Bearer YOUR_SITE_KEY',
  },
  body: JSON.stringify({ sessionKey }),
});

Python

import requests

requests.post(
    "https://app.clicklens.io/api/v1/sessions/convert",
    json={"sessionKey": session_key},
    headers={
        "Content-Type": "application/json",
        "Authorization": "Bearer YOUR_SITE_KEY",
    },
)

cURL

curl -X POST https://app.clicklens.io/api/v1/sessions/convert \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_SITE_KEY" \
  -d '{"sessionKey": "SESSION_KEY_VALUE"}'

Replace YOUR_SITE_KEY with the site key from Settings → Site Settings. The site key is public and grants no dashboard access; the endpoint only accepts session keys that already exist in your site's data.

Response codes

Code Meaning
200 Conversion recorded. The body is a uniform { "sessionKey": "...", "recorded": true } acknowledgement — it never reveals whether the conversion was accepted as verified-human ground truth, so a flagged caller cannot learn their session was caught.
400 Missing sessionKey in the request body.
401 Missing or invalid site key in the Authorization header.
404 No session matched the key — cookieless or ITP, or the call fired before any beacon. The conversion is still recorded against its click-id for later reconciliation, so a 404 here does not mean the conversion was dropped.

FAQ

Can a bot fake a conversion to clear itself?

No. A conversion never overrides the engine's own judgement. Reporting a conversion on a session the engine scored as a bot records the event but mints no human label, and a conversion never overturns a stronger verdict — a honeypot, manual, or complaint label stands.

Does reporting a conversion change the session's score?

The original session score is not changed. When a conversion is accepted as ground truth, a verified label is stored alongside the score and used by the efficacy dashboard to measure scoring accuracy over time.

Is it safe to call from the browser?

Yes. The tag call and the site key are both client-side by design. The site key identifies your site but grants no access to your dashboard or data, and the server-side endpoint only accepts session keys that already exist in your site's data.

Where do I find my site key?

In the dashboard, go to Settings → Site Settings. Your site key is shown in the integration section alongside the tag snippet.