Init reference

HumanBehaviorTracker.init(apiKey, options?) — Options from the shipped SDK types.

Signature

HumanBehaviorTracker.init(apiKey: string, options?: InitOptions): HumanBehaviorTracker

apiKey is required (constructor throws if missing).
For HumanBehaviorTracker.init, the second argument must be an options object, never a bare URL string — put the host in { ingestionUrl }.
CDN / UMD helper: window.humanbehavior.init(apiKey, ingestionUrl?, options?). Pass options as the third argument (init(apiKey, undefined, options)), or a bare URL string as the second argument.
init calls start() for you and returns a page-level singleton.

Illegal / deprecated patterns

Pattern	Status
`HumanBehaviorTracker.init(apiKey, "https://…")` as a bare second string	Invalid — use `{ ingestionUrl }`
`window.humanbehavior.init(apiKey, options)` with options as arg 2	Invalid — options become the ingestion URL; use `init(apiKey, undefined, options)`
Provider prop named `endpoint`	Invalid — use `options.ingestionUrl`
Calling init in a React Server Component	Unsupported — browser only
Top-level `redactFields: string[]`	Deprecated — use `redactionStrategy`

Correct pattern

HumanBehaviorTracker.init(apiKey, {
  ingestionUrl: "https://ingest.humanbehavior.co",
  redactionStrategy: { mode: "visibility-first" },
  release: "1.4.2",
  environment: "production",
  dist: "web",
  commitSha: process.env.NEXT_PUBLIC_GIT_SHA,
});

Options table

Defaults below match packages/core/src/tracker.ts (init + constructor). Opt-out flags default to enabled unless noted.

Option	Type	Default	Purpose
`ingestionUrl`	`string`	`https://ingest.humanbehavior.co`	Base URL for all `/api/ingestion/*` calls
`logLevel`	`'none' \| 'error' \| 'warn' \| 'info' \| 'debug'`	(SDK logger default)	SDK console verbosity
`redactionStrategy`	`{ mode, unredactFields?, redactFields? }`	mode `privacy-first`	Replay masking strategy — see Replay privacy
`redactFields`	`string[]`	—	Deprecated legacy unredact list
`enableAutomaticTracking`	`boolean`	`true`	Install autocapture / forms / rage / dead click
`automaticTrackingOptions`	object	see below	Fine-grained autocapture toggles
`suppressConsoleErrors`	`boolean`	`true`	Swallow narrow rrweb/CORS console noise (does not disable Issue capture)
`recordCanvas`	`boolean`	`false`	Opt-in canvas recording (throttled when on)
`enableAutomaticProperties`	`boolean`	`true`	Device / URL / UTM enrichment
`propertyDenylist`	`string[]`	`[]`	Keys excluded from automatic properties
`maxQueueSize`	`number`	`1000`	In-memory event queue cap
`enableConsoleTracking`	`boolean`	`true`	Capture `console.warn` / `console.error` → `/logs` (`console.log` is wrapped but not ingested)
`enableNetworkTracking`	`boolean`	`true`	Capture failed fetch/XHR (+ long loads) → `/network`
`enableErrorTracking`	`boolean`	`true`	Uncaught errors / rejections → `/errors`
`enableWebVitals`	`boolean`	`true`	Core Web Vitals as `$web_vitals` events
`enableTracing`	`boolean`	`true`	Page-load + resource + custom spans → `/spans/batch`
`release`	`string`	`null`	App version stamped on error reports
`environment`	`string`	`null`	Deployment stage stamped on error reports
`commitSha`	`string`	`null`	Git SHA for GitHub blob links on Issues
`dist`	`string`	`null`	Build discriminator; pairs with `release` for source maps
`captureRequestBodies`	`boolean`	`false`	Opt-in redacted request/response bodies on error-correlated requests
`minimumDurationMilliseconds`	`number`	`5000`	Hold outbound traffic until session age ≥ this; `0` = send immediately

`automaticTrackingOptions`

Field	Type	Default in code	Notes
`trackButtons`	`boolean`	`true`	Historical flag; autocapture uses a single click handler for interactive elements
`trackLinks`	`boolean`	forced `false`	Link-only channel is disabled — clicks on `<a>` still emit `$click` via autocapture
`trackForms`	`boolean`	`true`	Emits `$form_submitted` on `submit`
`includeText`	`boolean`	`true`	Include truncated element text on `$click`
`includeClasses`	`boolean`	`false`	Include `class` / `elementClass` on `$click`

`redactionStrategy`

Field	Type	When used
`mode`	`'privacy-first' \| 'visibility-first'`	Required when setting strategy
`unredactFields`	`string[]` (CSS selectors)	`privacy-first` — fields to show
`redactFields`	`string[]` (CSS selectors)	`visibility-first` — fields to hide

Password inputs are always protected (cannot be unredacted).

React provider

import { HumanBehaviorProvider } from "humanbehavior-js/react";

<HumanBehaviorProvider apiKey={apiKey} options={{ /* same InitOptions */ }}>
  {children}
</HumanBehaviorProvider>

Provider options mirror the table above (including release, environment, dist, commitSha, captureRequestBodies, vitals/tracing flags). On Next.js App Router, prefer a leaf client initializer — see Next.js.

Init reference

On this page