Documentation
Novexa Pilot needs one script tag and a verified domain. These pages cover the install itself, what np.js sends back, and the precise definition behind each metric — so nothing on a dashboard has to be guessed at.
Looking for a definition instead? Jump to the metric glossary.
The tag you install
under 6 KB gzipped
<script async src="https://cdn.novexapilot.com/np.js"
data-nk="pk_live_YOUR_PUBLIC_KEY"
data-np-host="yourdomain.com"
data-np-consent="respect_dnt"></script>Quick start
Add a domain in the app. Each one gets its own pk_live_ public key, hostname and consent mode baked into a ready-made tag under Domains → your domain → Settings.
Put it in your shared layout or template, not on one page at a time. It is async, has no dependencies, and never throws into the host page — on any internal error it disables itself silently.
Verification fetches your homepage looking for the tag and also checks whether a signed beacon arrived recently. Either one passing flips the domain to active.
Calling np() before the script has loaded
Add the command-queue stub above the tag and nothing fired early is lost — calls are buffered and replayed once np.js is ready.
<script>
window.np = window.np || function () { (np.q = np.q || []).push(arguments); };
</script>Browse by area
Areas without a written article yet link to the nearest real reference rather than a placeholder.
Register, open a domain access request, add your first domain, then paste one script tag into your site’s <head>. Nothing is counted until verification passes, so a mistyped hostname never pollutes anyone’s numbers.
Typical time from paste to first session: minutes.
First crawl finishes within the hour.
What np.js collects automatically, the five commands it exposes, and how to mark a field or a whole section as untracked.
Raw IPs are used for geo and ASN lookup, then discarded. Input values are never recorded. Anything matching an email, phone or card pattern is redacted on ingest.
Where every number on a dashboard comes from — sessions, bounce, scroll depth, conversion value — and the rollup tables they are read from.
What the crawler looks at, how the 0–100 health score is deducted from, and which issues are ranked critical rather than warning.
How a tracked visitor becomes a scored lead, what identify() links together, and how deals move through stages.
Developer API
Everything beyond automatic pageviews goes through the same np() function. There is no SDK to install and no build step — the tag defines the global, and these calls are safe to make from anywhere on the page.
np('event', 'signup_started', { plan: 'pro' });
np('conversion', 'demo_request', { value: 5000, currency: 'INR' });
np('identify', { email: 'a@b.com', name: 'Asha' });
np('consent', 'granted');
np('set', { userId: 'crm-123' });Debugging an integration? Append ?npdebug=1 to any page, or call np('debug', true) — every event is logged to the console and nothing is sent.
Data handling
Password fields, anything marked data-np-private, and everything inside [data-np-ignore] are skipped outright. For every other field the tracker records only that it was interacted with — never what was typed.
The IP is used server-side for country, region and ASN lookup, then discarded. The visitor identifier is a salted hash whose salt rotates every 24 hours, so the same person on two consecutive days is two visitors, not one.
Anything matching an email, phone-number or card pattern is stripped from event payloads before they are written — including from custom properties you send yourself.