API reference

@fixback/node reference

The complete API of @fixback/node. For a narrative walkthrough, see the Backend errors guide.

Exports

ts
import {  init,  captureException,  captureMessage,  setUser,  mintHostIdentity,} from "@fixback/node";// framework adapters (optional, subpath imports):import { fixbackRequestContext, fixbackErrorHandler } from "@fixback/node/express";import { FixbackModule } from "@fixback/node/nestjs";

init(options)

Call once, as early in the process as possible.

OptionTypeDescription
secretKeystringRequired. A secret key (sk_…) of the environment this server runs as — its errors land in that environment, so there is no environment option. Server-side only.
releasestringThe build identifier, symbolicated against sourcemaps uploaded for the same release.
enabledbooleanGate capture on or off — e.g. process.env.NODE_ENV === "production" to stay quiet in local dev.
beforeSend(event) => event | nullRedact fields, or drop an event entirely by returning null.
scrubbooleanRun the built-in PII scrubbers before beforeSend. Defaults to true.
apiUrlstringThe Fixback API origin. Override for a self-hosted deployment.
autoCapturebooleanThe umbrella for the two process handlers below. Defaults to true; false installs neither.
captureUncaughtExceptionbooleanInstall the polite uncaughtException handler. Defaults to autoCapture.
captureUnhandledRejectionbooleanInstall the polite unhandledRejection handler. Defaults to autoCapture.
requestIdHeaderstringThe header a request's Correlation id is read from when it carries no traceparent. Defaults to x-request-id.
captureBodiesbooleanAttach the failing request's body (the parsed req.body) and the response it sent (via res.json / res.send) to its errors, so the server Issue's request row shows the payload that failed and the response that explains it. Defaults to false — an opt-in for internal or staging debugging. The built-in scrubbers redact PII from bodies before they leave the process, and ingest redacts them again.
maxBodyBytesnumberThe per-body cap, in bytes, under captureBodies: a bigger body is dropped whole, never cut short. Defaults to 16384; at most 65536.

Set the two per-signal flags to override the umbrella individually — e.g. { autoCapture: false, captureUnhandledRejection: true } installs only the rejection handler.

Transport tuning

Sensible by default; reach for these only when your traffic shape asks for it.

OptionDefaultDescription
maxBatchSize100Flush once the buffer reaches this many errors. Capped at the server's limit of 500.
flushIntervalMs5000Flush a non-empty buffer at least this often.
maxQueueSize1024Cap the in-memory buffer so a flood can't grow it without bound.
timeoutMs30000Per-request transport timeout; 0 disables it.

The single init call also wires a batched secret-key transport (backs off on 429, honouring Retry-After) and process-level uncaughtException / unhandledRejection capture that never changes your process's exit behaviour. Each error carries the instant it was captured, so a batch flushed seconds later still records when every error happened.

Capture functions

FunctionDescription
captureException(err)Report a handled error (handled: true).
captureMessage(message, level?)Report a message string with a level (e.g. "warning").
setUser(ref)Attach an app-supplied, opaque user reference to errors captured during the current request.

mintHostIdentity(options)

A Host identity is the escape hatch for a product that already knows who its users are: your server mints a short-lived token from one of an environment's secret keys and hands it to a capture SDK (web or Expo) as its hostIdentity. Fixback verifies it and tiers the Reporter — Internal when the token's email is an Org Member, otherwise Invited — with no Connect round trip. A verified Host identity whose email matches a Fixback Account resolves to that same person, so the host and the platform are one Reporter.

It verifies only against the secret keys of the environment whose publishable key that capture SDK presents, so sign it with a key of the same environment — a staging server's secret mints nothing production accepts.

ts
import { mintHostIdentity } from "@fixback/node";// On your server, for a user you already authenticated:const hostIdentity = mintHostIdentity({  secretKey: process.env.FIXBACK_SECRET_KEY!, // sk_… — never ship it to a client  subject: user.id,                            // your stable id for the user (JWT sub)  email: user.email,                           // optional — Member ⇒ internal tier  expiresInSeconds: 3600,                       // optional — defaults to one hour});// Hand it to a capture SDK as its hostIdentity option://   web:  Fixback.init({ key: "pk_…", hostIdentity })//   expo: <FixbackProvider options={{ key, origin, hostIdentity }} />
OptionTypeDescription
secretKeystringRequired. A secret key (sk_…) of the same environment as the capture SDK's publishable key, issued in the dashboard. Signs the token; keep it server-side.
subjectstringRequired. Your stable identifier for the user — the JWT sub, which keys the Reporter.
emailstringThe user's email. Decides internal vs invited, and unifies the Reporter with a matching Account. Omit for a valid-but-external identity (invited).
expiresInSecondsnumberToken lifetime; defaults to one hour. An exp is always set — an identity assertion must expire.

The recipe is an HS256 JWT signed with sha256(secretKey) — the value Fixback stores for the key and verifies against (the secret plaintext is shown once at issuance and never kept). This helper is that recipe, so you never hand-roll JWT signing. Issue and revoke secret keys on the Project's Keys page, for the environment picked in the switcher; a revoked key stops verifying at once.

Express adapter — @fixback/node/express

MiddlewareWhereDescription
fixbackRequestContext()before your routesOpens per-request context so captures carry request metadata.
fixbackErrorHandler()after your routesCaptures errors that reach next(err).

NestJS adapter — @fixback/node/nestjs

ExportDescription
FixbackModule.forRoot()Registers the request-context middleware and a global exception filter that captures thrown request errors and re-throws them, leaving your own error handling unchanged.

The Correlation id

The request-context middleware (either adapter) gives every request one id, and errors captured during the request carry it. It takes the first source that has one:

  1. the trace id of an inbound W3C traceparent header — what the browser SDK sends on your page's same-origin requests and to the origins listed in its propagateTo, and what the Expo SDK sends to the origins listed in its own;
  2. the requestIdHeader — x-request-id unless you configured another;
  3. a freshly minted id.

A malformed traceparent is ignored whole, never partly used, and the next source applies. When the page's request carried the id, the server Issue's request row and the browser Issue's network row show the same Correlation id, and the server Issue lists the page Issues it was seen from — with their replay — while each of those names it as the server error behind its request. Both capture SDKs send the sampled flag (01), so a parent-based OpenTelemetry sampler on this server records those requests rather than dropping them.