@obsrviq/tracker

The Obsrviq capture SDK. A tiny, privacy-first script that records DOM (rrweb), console, network, errors, and web vitals, then ships them in masked, gzipped batches. No tagging required.

Install

Script tag (no build):

<script
  src="https://cdn.yourapp.com/obsrviq.global.js"
  data-obsrviq-key="pk_live_xxx"
  data-obsrviq-endpoint="https://in.yourapp.com"></script>

The built file is dist/obsrviq.global.js (host it on your CDN).

npm:

npm install @obsrviq/tracker

import { Obsrviq } from '@obsrviq/tracker';
Obsrviq.init({ siteKey: 'pk_live_xxx', endpoint: 'https://in.yourapp.com' });

API

Obsrviq.init(config);                 // see config below
Obsrviq.identify(userId, traits?);    // raw userId (searchable) + SHA-256 hash; retro-stamps
Obsrviq.setMetadata({ plan: 'pro' }); // merge searchable session properties anytime
Obsrviq.reset();                      // forget identity on logout → fresh anonymous session
Obsrviq.track('event', { conversion: true });
Obsrviq.setConsent(true | false);     // gate recording (PRIV-2)
Obsrviq.stop();                       // hard stop + flush
Obsrviq.getDiagnostics();             // { recording, sessionId, flushes, bytesSent, … }

Config

| Option | Default | Notes | |---|---|---| | siteKey | — | Required. The pk_ ingest key. | | endpoint | https://in.lumera.app | Your ingest URL. | | maskAllInputs | true | Never record input values. | | maskTextSelector | — | Mask text inside matching nodes. | | blockSelector | .obsrviq-block | Never record these nodes. | | captureNetworkBodies | false | Opt-in, masked, size-capped. | | redactHeaders | authorization, cookie, set-cookie | Redacted in captured headers. | | requireConsent | false | If true, nothing records until setConsent(true). | | sampleRate | 1.0 | 0..1 fraction of sessions to record. | | flushIntervalMs | 5000 | Batch flush cadence. | | beforeSend | — | Last-chance redaction; return null to drop. |

Behavior

• Consent & privacy: with a consent gate and consent withheld, zero network calls leave the page (honors Global Privacy Control / DNT).
• Transport: gzipped via fflate, sent with sendBeacon (or fetch keepalive) on a timer, on visibilitychange=hidden, and on pagehide.
• Capture: rrweb for DOM (periodic full snapshots for progressive replay); custom interceptors for fetch / XHR / PerformanceObserver / sendBeacon; console hooks; window.onerror + onunhandledrejection; web vitals; rage/dead click detection.

Full guide: docs/EMBEDDING.md.