Install with an agent
Hand the install to a coding agent instead of wiring it by hand.
Claude Code users
The Vibiz plugin ships this as a skill, so you can just ask: install Vibiz analytics. See Claude Code. The prompt below is for every other agent, and for a session without the plugin.
Paste this into Claude Code, Cursor, Codex, or any coding agent with access to your repository. Replace the org id on the first line with yours, which is on the Intelligence screen. Or copy it from Leads > Intelligence, where your org id is already filled in.
It sends the agent to read the documentation rather than restating it, so it cannot go stale against the product the way a copied checklist does.
Install Vibiz analytics in this repository. My org id is org_REPLACE_ME.
Read these first, they are the source of truth and they are short:
https://www.vibiz.ai/docs/analytics/install.md
https://www.vibiz.ai/docs/analytics/events.md
https://www.vibiz.ai/docs/analytics/identify.md
https://www.vibiz.ai/docs/analytics/consent.md
https://www.vibiz.ai/docs/analytics/packages.md
https://www.vibiz.ai/docs/analytics/verify.md
Then work in this order and do not skip a step:
1. Detect the framework and check whether Vibiz is already installed
(@vibiz/analytics, data-vibiz-id, sdk/v1/v.js). If init is already wired,
report what you found and continue from step 4: only add what is missing
(allowed domains reminder, identify, sign_up/login, purchase). Do not
remove a working install to start over.
2. Install @vibiz/analytics with the package manager this repo already uses
(current API uses init({ orgId }), not the old workspaceId name from 0.2.0;
install @vibiz/analytics@^0.4.1)
and call init({ orgId }) once at the app root, on the client.
3. For anything the browser cannot see, a webhook, a background job, a payment
confirmed after the tab closed, use @vibiz/analytics/node. Those calls must
carry the visitor's own url, clientIp, clientUserAgent and clientCountry, not
my server's. Capture them on the request that came from the browser and store
them with the record you will report later.
4. Allow the site's origins. If you have the Vibiz MCP connected, call
vibiz_analytics_setup_update with addOrigins. Otherwise STOP and tell me
which exact origins to allow: it is behind my login, and until it is done
nothing sent from a browser is kept. Give me full origins, not domains, because the
match is exact: https://www.example.com and https://example.com are
different, and so is http://. Include every host the site serves from.
5. Only after I confirm the origins, finish event instrumentation the
autocapture cannot know:
- Consent: call setConsent({ advertising: true }) when my CMP grants it, or
wire it to the consent tool already on the site. Without advertising
consent, identify contact details are never stored.
- On signup or login: identify(userId, { email, ... }) FIRST, then
track('sign_up') or track('login'). identify alone sends nothing; contacts
travel on the next track. Never put email in track props.
- purchase (and subscribe / refund) after payment is confirmed, with value,
currency and order_id.
Do not re-instrument page views, clicks, form submits, rage clicks or scroll
depth, which are already captured.
6. Verify. /api/ingest answers 204 to everything, including a wrong org id and a
disallowed origin, so a 204 proves the event was sent and nothing else. The
only proof is that the events appear in my workspace (with the Vibiz MCP:
recentEventsByOrigin and rejectedOrigins in vibiz_analytics_setup). Do not
report success from a status code.
7. Run this project's own typecheck and linter over the files you touched, and
only those. Tell me which events you instrumented and which you left to
autocapture, so nobody adds them twice later.Why step 4 is shouted at
Every workspace starts with an empty allowed list, and an empty list keeps nothing that arrives from a browser. That is deliberate: it is the only thing standing between your workspace and anyone who reads your org id out of a page source, and the org id is public by design.
The consequence for an agent is that a perfectly correct install looks broken.
It writes the code, loads a page, sees 204, finds no events, and concludes it
made a mistake. Left to itself it will start changing working code.
Telling it to stop and hand the step back to you costs one message and removes the whole failure. You do not have to know which origin to give it either: load a page with the tag on it, and Intelligence names the origin it is hearing from with a button to allow it.