API reference
@fixback/node reference
@fixback/node. For a narrative walkthrough, see the Backend errors guide.Exports
import { init, captureException, captureMessage, setUser, mintHostIdentity,} from "@fixback/node";// framework adapters (optional, subpath imports):import { fixbackRequestContext, fixbackErrorHandler } from "@fixback/node/express";import { FixbackModule } from "@fixback/node/nestjs";init(options)
Call once, as early in the process as possible.
| Option | Type | Description |
|---|---|---|
secretKey | string | Required. A secret key (sk_…) of the environment this server runs as — its errors land in that environment, so there is no environment option. Server-side only. |
release | string | The build identifier, symbolicated against sourcemaps uploaded for the same release. |
enabled | boolean | Gate capture on or off — e.g. process.env.NODE_ENV === "production" to stay quiet in local dev. |
beforeSend | (event) => event | null | Redact fields, or drop an event entirely by returning null. |
scrub | boolean | Run the built-in PII scrubbers before beforeSend. Defaults to true. |
apiUrl | string | The Fixback API origin. Override for a self-hosted deployment. |
autoCapture | boolean | The umbrella for the two process handlers below. Defaults to true; false installs neither. |
captureUncaughtException | boolean | Install the polite uncaughtException handler. Defaults to autoCapture. |
captureUnhandledRejection | boolean | Install the polite unhandledRejection handler. Defaults to autoCapture. |
requestIdHeader | string | The header a request's Correlation id is read from when it carries no traceparent. Defaults to x-request-id. |
captureBodies | boolean | Attach the failing request's body (the parsed req.body) and the response it sent (via res.json / res.send) to its errors, so the server Issue's request row shows the payload that failed and the response that explains it. Defaults to false — an opt-in for internal or staging debugging. The built-in scrubbers redact PII from bodies before they leave the process, and ingest redacts them again. |
maxBodyBytes | number | The per-body cap, in bytes, under captureBodies: a bigger body is dropped whole, never cut short. Defaults to 16384; at most 65536. |
Set the two per-signal flags to override the umbrella individually — e.g. { autoCapture: false, captureUnhandledRejection: true } installs only the
rejection handler.
Transport tuning
Sensible by default; reach for these only when your traffic shape asks for it.
| Option | Default | Description |
|---|---|---|
maxBatchSize | 100 | Flush once the buffer reaches this many errors. Capped at the server's limit of 500. |
flushIntervalMs | 5000 | Flush a non-empty buffer at least this often. |
maxQueueSize | 1024 | Cap the in-memory buffer so a flood can't grow it without bound. |
timeoutMs | 30000 | Per-request transport timeout; 0 disables it. |
The single init call also wires a batched secret-key transport (backs off on 429, honouring Retry-After) and process-level uncaughtException / unhandledRejection capture that never changes your process's exit behaviour. Each error carries the instant it was captured, so a batch flushed seconds later still records when every error happened.
Capture functions
| Function | Description |
|---|---|
captureException(err) | Report a handled error (handled: true). |
captureMessage(message, level?) | Report a message string with a level (e.g. "warning"). |
setUser(ref) | Attach an app-supplied, opaque user reference to errors captured during the current request. |
mintHostIdentity(options)
A Host identity is the escape hatch for a product that already knows who its
users are: your server mints a short-lived token from one of an environment's secret keys and
hands it to a capture SDK (web or Expo) as its hostIdentity. Fixback verifies it and
tiers the Reporter — Internal when the token's email is an Org
Member, otherwise Invited — with no Connect round trip. A verified Host identity
whose email matches a Fixback Account resolves to that same person, so the host and the platform
are one Reporter.
It verifies only against the secret keys of the environment whose publishable key that capture SDK presents, so sign it with a key of the same environment — a staging server's secret mints nothing production accepts.
import { mintHostIdentity } from "@fixback/node";// On your server, for a user you already authenticated:const hostIdentity = mintHostIdentity({ secretKey: process.env.FIXBACK_SECRET_KEY!, // sk_… — never ship it to a client subject: user.id, // your stable id for the user (JWT sub) email: user.email, // optional — Member ⇒ internal tier expiresInSeconds: 3600, // optional — defaults to one hour});// Hand it to a capture SDK as its hostIdentity option:// web: Fixback.init({ key: "pk_…", hostIdentity })// expo: <FixbackProvider options={{ key, origin, hostIdentity }} />| Option | Type | Description |
|---|---|---|
secretKey | string | Required. A secret key (sk_…) of the same environment as the capture SDK's publishable key, issued in the dashboard. Signs the token; keep it server-side. |
subject | string | Required. Your stable identifier for the user — the JWT sub, which keys the Reporter. |
email | string | The user's email. Decides internal vs invited, and unifies the Reporter with a matching Account. Omit for a valid-but-external identity (invited). |
expiresInSeconds | number | Token lifetime; defaults to one hour. An exp is always set — an identity assertion must expire. |
The recipe is an HS256 JWT signed with sha256(secretKey) — the value
Fixback stores for the key and verifies against (the secret plaintext is shown once at issuance
and never kept). This helper is that recipe, so you never hand-roll JWT signing. Issue and revoke
secret keys on the Project's Keys page, for the environment picked in the
switcher; a revoked key stops
verifying at once.
Express adapter — @fixback/node/express
| Middleware | Where | Description |
|---|---|---|
fixbackRequestContext() | before your routes | Opens per-request context so captures carry request metadata. |
fixbackErrorHandler() | after your routes | Captures errors that reach next(err). |
NestJS adapter — @fixback/node/nestjs
| Export | Description |
|---|---|
FixbackModule.forRoot() | Registers the request-context middleware and a global exception filter that captures thrown request errors and re-throws them, leaving your own error handling unchanged. |
The Correlation id
The request-context middleware (either adapter) gives every request one id, and errors captured during the request carry it. It takes the first source that has one:
- the trace id of an inbound W3C
traceparentheader — what the browser SDK sends on your page's same-origin requests and to the origins listed in itspropagateTo, and what the Expo SDK sends to the origins listed in its own; - the
requestIdHeader—x-request-idunless you configured another; - a freshly minted id.
A malformed traceparent is ignored whole, never partly used, and the next source
applies. When the page's request carried the id, the server Issue's request row and the browser
Issue's network row show the same Correlation id, and the server Issue lists the page Issues it
was seen from — with their replay — while each of those names it as the server
error behind its request. Both capture SDKs send the sampled flag
(01), so a parent-based OpenTelemetry sampler on this server records those requests
rather than dropping them.