Project settings

Everything here lives on one page per project: Settings.

Allowed origins

One origin per line:

https://acme.com
https://staging.acme.com

Only these origins may send reports with your key. Leave it empty and reports are accepted from anywhere, which is fine while you are testing and wrong once the site is public.

Your API

The URL prefixes of your own backend:

https://api.acme.com
https://acme.com/api

Two things use this list.

The error prompt. When a request to one of these fails while a visitor is browsing, the widget offers them a one-click report — "Something broke on our side. Tell us what you were doing?" — with the failure already described. It gives up after 20 seconds and never nags.

Not every failure is worth interrupting someone over:

A request refused on its merits is usually the interface working. Prompting on every failed form validation is how a prompt becomes something people dismiss without reading.

Leave this empty and nobody is ever interrupted. A visitor pulled into a report by someone else's broken ad script is worse than no report at all.

The second use is ownership: requests to these origins count as your code when deciding what is worth keeping. See What gets captured.

Masked elements

CSS selectors whose contents are blurred before the screenshot is taken:

.customer-name
#invoice-total

Password inputs are always masked, without asking. Blurring happens in the browser, before the image exists — not to the image afterwards.

A selector that does not parse is skipped rather than thrown, so a typo cannot break capture.

This is an internal site

Turn on for staging, admin tools, anything only your team visits. Reporters get one extra field: a link to a related ticket, design or doc.

Leave it off for anything a client can reach. The field is gated twice — the widget hides it, and the server drops the value regardless of what was posted.

Capture request bodies

Off by default. Bodies are the one thing a report can carry that is genuinely your customers' data, so a project has to ask for them.

When you turn it on, four rules hold at once:

• Failed requests only — no response, or status 400 and above
• Your API only — first-party URLs, never third parties
• Redacted in the browser, before the report is sent. Any key matching password, token, secret, auth, api key, cvv, card, iban, otp, session or cookie becomes [redacted]. Redacting on the server would already be too late
• Truncated to 2 kB

Headers and cookies are never captured, with or without this setting, and there is no way to turn them on.