# Script tag

```html
<script>window.doubleagent=window.doubleagent||{q:[],push(){this.q.push(arguments)}};</script>
<script async src="https://cdn.doubleagent.so/v1/doubleagent.js" data-profile="auto"></script>
```

| Attribute | Default | |
|---|---|---|
| `data-key` | none (keyless) | Public key, `pk_live_…` or `pk_test_…`. Optional; see [Capabilities](/docs/capabilities). Safe to expose. |
| `data-profile` | `auto` | See [Clearance](/docs/clearance). |
| `data-endpoint` | `https://api.doubleagent.so` | Only for a self-hosted API. |
| `data-live` | on for `pk_test_`, off for `pk_live_` | Live presence for HQ's *Live now* panel (one small ping per open tab every few seconds). `data-live="false"` turns it off. Needs a key. |

## Content Security Policy

If your site sends a CSP, add these:

```
script-src  https://cdn.doubleagent.so
connect-src https://api.doubleagent.so
worker-src  blob:
```

`worker-src blob:` lets the SDK solve proof of work in a background worker. Without it, the SDK still works: it does the same work on the main thread, and the browser logs a CSP warning. The queue-stub `<script>` is inline, so a strict CSP needs a nonce or hash for it, or you can leave the stub out if nothing calls `window.doubleagent` before the SDK loads.

## Testing on localhost

Use the site's **test key** (`pk_test_…`) on your machine. It works on `localhost`, `*.localhost`, `127.0.0.1` and `[::1]`, on any port, with no domain to add. Those sessions show in the portal's HQ under **Test data (localhost)**, even before your real domain is verified. Switch to the live key (`pk_live_…`) for production. Live keys only work on verified domains.

Everything else goes in a queued `init`, which is merged over the attributes:

```js
doubleagent.push('init', { mode: 'analytics', consent: 'auto', block: { adConversions: 'bot', forms: false } });
```

npm:

```ts
import { doubleagent } from '@doubleagent-so/js';
doubleagent.init({});                     // keyless
doubleagent.init({ key: 'pk_live_xxx' }); // keyed; after a keyless start this upgrades in place
```