Debug Customer.io in Chrome DevTools

What Customer.io traffic looks like

Customer.io spreads across five hostnames and only two of them say "customer.io" in a way anyone recognizes. The in-app messaging infrastructure in particular runs on a domain with no obvious connection to the vendor, which is exactly the case an inventory tool exists for.

Endpoint pattern

track.customer.io is the behavioural tracking API; cdp.customer.io serves Data Pipelines, Customer.io's Segment-compatible CDP; assets.customer.io serves in-app message assets; customerioforms.com handles hosted forms; and consumer.cloud.gist.build is the in-app messaging service, which carries no Customer.io branding in its hostname at all

Transport

JSON posts for identify and track calls. Data Pipelines traffic follows the Segment specification, so calls on cdp.customer.io will look familiar to anyone who has read Segment traffic

Key parameters

The identifier used for the person (commonly an email or an internal user id) · the event name and its attributes · the site or workspace identifier

Notes

The Segment-compatible path means a site can be sending Customer.io data through an analytics.js-shaped library rather than Customer.io's own snippet, and the two look different on the wire

Debugging Customer.io with Event Watcher

• No dedicated parser. Requests are matched by hostname, named Customer.io, badged with the Marketing Automation category, and shown with parsed query and body parameters plus cookies set and sent.
• The value here is naming: consumer.cloud.gist.build in a raw network log tells you nothing, and the extension resolves it to Customer.io. That is the difference between an unexplained third party in an audit and a known one.
• Group by Endpoint to see which parts of the product a site uses. Tracking without any gist.build traffic means in-app messaging is not deployed, which is useful when a message is not showing.
• Open an identify call to see which identifier the site sends. Sending an email address as the identifier is common and has consequences downstream.
• Script Tree attributes the snippet to the site's template, a tag manager, or another script.

Customer.io and consent

Event Watcher checks Customer.io against the marketing consent category.

Customer.io is messaging infrastructure, so the tracking exists to trigger campaigns rather than to produce reports. The gist.build host is the part worth checking deliberately: in-app messaging both collects and renders, so it can be active on a page where nobody expected a marketing tool to be doing anything visible. Deny marketing, reload, and confirm all five hostnames stay quiet rather than only the one with the obvious name.

Common debugging scenarios

• An event is not triggering a campaign. Open the track call and confirm the event name matches the campaign trigger exactly, including case.
• A person is not being recognized. Check the identifier on the identify call. Switching between an email and an internal id part-way through a session creates two people.
• An in-app message does not appear. Look for consumer.cloud.gist.build traffic. No traffic means the message never had a chance to render, which is a different problem from a targeting rule excluding it.
• Two implementations at once. Traffic on both track.customer.io and cdp.customer.io may be intentional, or a half-finished migration to Data Pipelines. Compare what each sends.
• Customer.io fires before consent. Filter to it and read the consent verdict on the first request from any of its hosts.