Tracebird/Docs
SiteDashboard

Configuration

web

Everything init() accepts, and how the project key model keeps a public key safe.

Options

main.ts
import { init } from "@tracebird/web";

init({
  projectKey: "pk_live_a1b2c3",   // required
  endpoint: "https://api.tracebird.dev",
  environment: "staging",
  release: "1.4.2",
  tester: "karim@acme.dev",
});
optiontypedefaultdescription
projectKeystring—Your project's public key, from Settings. Without it the SDK disables itself and logs a warning.
endpointstringapi.tracebird.devIngest API base URL. Point it at your own host when self-hosting.
environmentstring—Free-form label (staging, preview, production…) shown on every report and filterable in the inbox.
releasestring—Your app version. Lets the inbox tell you a bug appeared in v1.4.2 and stopped in v1.4.3.
testerstring—Optional identification (name or email) attached to reports. Testers never need an account.

The key is public — by design

pk_live_… ships in your client bundle, so anyone can read it. Abuse is contained server-side, per project:

  • Origin allowlist — the Origin header of every ingest call must match a domain you listed in Settings. Unknown key and disallowed origin return the same 403, so the endpoint can't be used to probe for valid keys.
  • Rate limiting — per-IP backstop on the ingest API.
  • Size caps — 8 MB per report, with per-field limits on logs, requests and media.
⚠ heads upAdd every domain your testers will use — including preview deploys and localhost ports during development. A missing origin is the number one reason a report silently fails with a 403.

Where to put init()

As early as possible — the console, network and error buffers only capture what happens after the SDK is installed. In a SPA, call it once at the top of your entry module, not per route.

← previousQuickstartnext →Capture & annotation