Enable session replay ¶

Session replay and crash snapshots are still being rolled out and are gated on the personvernombud (data protection officer) process. Treat this as a preview: keep both off unless your team has explicitly decided, through its own privacy assessment, to turn on screen recording for its users.

Session replay lets you see what a user's screen looked like around an error. @nais/apm can record a masked replay of the session, or capture a single masked snapshot when an error occurs. Both are off by default and enabled per app, in init().

The decision is yours to make ¶

Session replay and crash snapshots are opt-in for a reason: a team must decide, deliberately, to turn on screen recording for its own users. This is not a technical toggle to flip lightly — it reflects the personvernombud (data protection officer) process, and each team is responsible for making that call for its own application and users, in line with its own privacy assessment.

Enable it only after that decision is made. For citizen-facing applications in particular, involve your privacy assessment before turning it on.

The masking floor (non-overridable) ¶

To make that decision safer whichever way it goes, both features share a masking floor applied in the browser before any byte leaves the user's machine:

every form input value is masked, with no exceptions — inputs can never be unmasked;
all text is masked, except elements you explicitly mark with a data-apm-unmask attribute;
images, video, audio, canvas, iframes, embeds, and anything marked data-apm-block are always blocked, never inlined;
stylesheets and images are never inlined into the capture.

The block option can only add more selectors to block. There is no option to relax any part of the masking floor.

Enable full session replay ¶

import { init } from '@nais/apm';

init({
  sessionReplay: {
    enabled: true,
    mode: 'on-error', // or 'always'
    sampleRate: 0.5, // fraction of sessions recorded, 0..1
    block: ['.no-record-me'], // extra selectors to block; tighten-only
  },
});

mode: 'on-error' (default) buffers the last ~60–120 seconds in memory and ships it only once an error actually occurs. Nothing leaves the browser before that.
mode: 'always' streams continuously, gated by sampleRate.

Or capture a crash snapshot only ¶

If a full recording is more than you need, capture one masked DOM snapshot per new error instead:

init({ screenshotOnError: true });

screenshotOnError is throttled and capped per session. It's automatically disabled when sessionReplay is enabled, because a recording already contains the same information.

See the replay ¶

Once enabled and deployed, replays and snapshots attach to their issue: open the issue in the Issues tab and the drawer shows the masked replay alongside the stack trace.

@nais/apm API reference — full sessionReplay options.
Track frontend errors with @nais/apm