Reference

Browser SDK Reference

Every option createRecorder and anyreplay('init') accept, with defaults, plus the RecorderHandle methods, script tag commands and recorder status values.

Reference for @anyreplay/browser 0.3.0. The script tag and the npm package share the same options and behaviour; only the calling style differs.

Options

Passed to createRecorder(options) or anyreplay('init', options).
Option	Type	Default	Description
`projectKey`	`string`	Required	Public key from your project, `ar_pk_live_…` or `ar_pk_test_…`. A malformed key is a configuration error.
`ingestUrl`	`string`	`https://in.anyreplay.com`	Where recordings are sent. Change it only for a self-hosted install. A trailing slash is removed.
`sampleRate`	`number`	`1`	Share of visitors recorded, 0–1, decided once per visitor. See sampling.
`maskAllInputs`	`boolean`	`true`	Masks the value of every form field. On by default; `false` records what a visitor types. Passwords, one-time codes, payment fields and card numbers — even one still being typed, or one written inside longer text, whose digits after the sixth are hidden — are masked whatever this says; email and telephone inputs are ordinary fields and follow this option. Only an explicit `false` turns it off. See masking and blocking.
`maskAllTyping`	`boolean`	`false`	The stricter switch: masks form fields and the text of every `contenteditable` element, which is where a rich-text editor keeps what was typed. It masks fields whatever `maskAllInputs` says. Only an explicit `true` turns it on.
`maskClass`	`string`	`'ar-mask'`	Elements with this class have their text masked, and form fields inside them have their values masked.
`blockClass`	`string`	`'ar-block'`	Elements with this class are not recorded; replay shows a placeholder.
`requireConsent`	`boolean`	`false`	Record nothing, and store nothing in the browser, until `consent(true)`. See consent.
`maxEventsPerChunk`	`number`	`200`	Send a chunk when this many events are buffered.
`flushIntervalMs`	`number`	`5000`	Send a chunk at least this often, in milliseconds.
`maxConsecutiveFailures`	`number`	`0` (never)	Stop recording after this many failed deliveries in a row — offline, a timeout, `429` or `5xx`. By default the recorder never gives up on a network that is away: it keeps up to ten chunks of events, waits 2 s doubling to a minute (never less than a `Retry-After` asks), and tries at once when the browser is back online or the tab is visible again. Set a number only if you want it to give up. (Before 0.2.0 the default was `5`.)
`recordErrors`	`boolean`	`true`	Record uncaught exceptions and unhandled rejections — message, error name, stack and the file and line that threw. At most 100 per session.
`recordConsole`	`boolean`	`true`	Record `console.error` and `console.warn` calls, arguments joined into one line. `log`, `info` and `debug` are never recorded at any setting. At most 200 per session.
`recordNetwork`	`boolean`	`true`	Record one entry per `fetch`/`XMLHttpRequest`: method, URL, status code and duration. No request or response body, and no headers. Requests to `ingestUrl` are skipped. At most 500 per session.
`maxSessionsPerMonth`	`number`	None	Cap on new sessions for the project per calendar month (UTC), 1–1,000,000. The lower of this and the dashboard cap applies. See session caps.
`appId`	`string`	None	Only for a page inside an app shell (Capacitor, Cordova, Electron, Tauri): the app's bundle id or package name, such as `com.example.shop`. Such a page has no real web origin, so a project with allowed domains refuses it unless this id is on the project's Allowed apps. Ignored on a real website, and a filter rather than a secret. Since 0.2.0.
`assets`	`'reference' \| 'inline'`	`'inline'` in an app, `'reference'` on a website	Whether the replay loads the page's images and fonts from their URLs (`reference`), or the recording carries them (`inline`): images the page ships are uploaded once per project by hash (PNG, JPEG, GIF, WebP, up to 3 MB), fonts (up to 160 KB) and SVGs (up to 48 KB) travel inside the recording. Without a value it is `inline` when the page is not served over `http(s)` — an app's web view, such as `capacitor://localhost` or `file://` — and `reference` for every `http(s)` page, `localhost` included, so a site you try on your own machine does not upload its images to your project. The Capacitor, Cordova, Electron and Tauri SDKs pass `inline` themselves, which covers the apps served from `https://localhost` or `http://tauri.localhost`. Only files under the page's own origin are read. Since 0.2.0.
`debug`	`boolean`	`false`	Log warnings to the console: why recording stopped, why a `track` call was dropped.

createRecorder throws a ConfigError for a missing options object, a malformed projectKey, a sampleRate outside 0–1, or a maxSessionsPerMonth that is not a whole number from 1 to 1,000,000. With the script tag the same error is caught and logged as a warning.

What the diagnostics streams keep

Errors, console lines and request metadata ride inside the recording, on its own clock, and show in the player's Console and Network tabs beside the replay. They are also what the js_error, error_click and network_error signals are built from, so Argus can say an error happened and show you the click before it.

Three things are taken out of every URL, message and stack before any of it is kept: a query value whose key names a secret (token, api_key, session, code, signature and the like), anything shaped like an email address, and any long opaque token or card-shaped number. A URL's fragment is dropped entirely, and so are credentials in its authority. What is left is the origin, the path and the surviving query.

RecorderHandle

Returned by createRecorder. None of these methods throws.

Method	Returns	Description
`track(name, properties?)`	`void`	Tags this moment. `name`: 1–64 characters of `[A-Za-z0-9_.:-]`; `properties`: plain JSON object ≤ 4 KB. See custom events.
`trackError(error)`	`void`	Records an error you caught yourself as the same error event an uncaught one becomes: redacted by the same rules, counted against the same 100-per-session ceiling, and marking the session as having an error. Takes anything that can be thrown. Held like `track` while waiting for consent; ignored with `recordErrors: false`. Since 0.2.0.
`identify({ userId?, email? })`	`void`	Attaches an identity to the session. Best-effort. Called while waiting for consent, the traits are held and sent once recording starts. See identify users.
`consent(granted)`	`void`	`true` starts a recorder waiting for consent, creating its visitor id and session as it does; `false` removes the visitor id and session state from storage and stops a recording for this page. A `false` given before recording started leaves the recorder waiting, so a later `true` still starts it (before 0.2.0 it stopped).
`status()`	`RecorderStatus`	The current state; see below.
`sessionId()`	`string \| null`	The session id, for your own logs and support tools. `null` while waiting for consent.
`flush()`	`Promise<void>`	Sends buffered events now; resolves when the request completes.
`stop()`	`void`	Stops recording for this page.

Script tag commands

Command	Equivalent
`anyreplay('init', options)`	`createRecorder(options)` — once per page; later calls are ignored
`anyreplay('track', name, properties?)`	`handle.track(name, properties)`
`anyreplay('trackError', error)`	`handle.trackError(error)` (since 0.2.0)
`anyreplay('identify', traits)`	`handle.identify(traits)`
`anyreplay('consent', granted)`	`handle.consent(granted)` — anything other than `false` counts as granted
`anyreplay('flush')`	`handle.flush()`
`anyreplay('stop')`	`handle.stop()`

Calls made before the recorder has loaded are queued by the snippet and run in order. Unknown commands are ignored.

RecorderStatus

Value	Meaning
`idle`	Created, not yet recording. Brief.
`awaiting-consent`	`requireConsent` is on and `consent(true)` has not been called — or `consent(false)` was called before recording started. Nothing has been stored, observed or sent.
`recording`	Recording and delivering chunks.
`sampled-out`	This visitor is outside `sampleRate`. Nothing will be recorded; every method is a no-op.
`stopped`	Stopped by `stop()`, `consent(false)` while recording, a refusal from ingest, too many failed deliveries (only when `maxConsecutiveFailures` is set), or a recent 402 in this tab.

Other exports

The package also exports resolveOptions, DEFAULTS, ConfigError, isSampledIn and the AnyReplayOptions type, which are useful in tests. Everything else it exports is internal and may change between versions. Source: browser/src.

Storage keys

The recorder keeps its visitor id in localStorage (anyreplay.vid) and the current session, chunk number, page count and a short refusal cool-down in sessionStorage (anyreplay.sid, anyreplay.sts, anyreplay.seq, anyreplay.pc, anyreplay.cd). It sets no cookies, and its requests are sent without credentials. With requireConsent: true none of these keys is written until consent(true), and consent(false) removes them all. If storage is unavailable it keeps working without remembering anything.