JavaScript SDK

Install

Paste one tag before </head>. There is no server-side SDK and nothing to call from your own code — tracking starts on its own.

<script
  src="http://localhost/cliksora/sdk/v1/cliksora.min.js"
  data-project="YOUR_PROJECT_PUBLIC_KEY"
  data-host="http://localhost/cliksora"
  async></script>

rrweb is not in that 14.8 KB. The recorder is fetched separately and only when session recording is switched on for the project, so a project with recording off never pays its ~78 KB.

window.ClikSora = window.ClikSora || { q: [] };
ClikSora.q.push(['identify', 'USER_1001']);

Script attributes

Collected automatically

On load the SDK resolves the project, fetches its configuration, verifies the domain, establishes visitor and session identity, evaluates consent, and only then starts collecting. A project it cannot reach collects nothing — the defaults are off, and the remote configuration is what turns features on.

JavaScript API

Every method is safe to call before the SDK finishes initialising — calls are queued and replayed in order, up to 200 of them. An identify() in your page head runs before our configuration request returns, and dropping it would silently break identified-user recording.

ClikSora.identify('USER_1001', { role: 'customer', plan: 'premium' });

ClikSora.setUserProperties({ plan: 'growth', seats: 12 });

ClikSora.track('purchase_completed', { orderId: 'ORD_1001', amount: 1500 });

ClikSora.startRecording();

ClikSora.reset(); // on logout

ClikSora.endSession();

ClikSora.optOut();

ClikSora.grantConsent();

ClikSora.shutdown();

await ClikSora.init({ projectKey: 'YOUR_KEY', debug: true });

ClikSora.getState();
// {
//   initialised:       true,
//   project_id:        '…',
//   visitor_id:        '…',
//   session_id:        '…',
//   user_id:           'USER_1001',
//   recording:         true,
//   recording_allowed: true,
//   pending_events:    0,
//   segments_uploaded: 3,
//   version:           '1.0.0'
// }

Privacy markup

Masking happens in the browser, before transmission. Masked values never exist in the event stream — not merely in what is sent.

Markers you can add to your own pages

cliksora-block and cliksora-mask also work as data-cliksora-block and data-cliksora-mask, for templates where adding a class is awkward. Privacy always wins over recording permission: a visitor who has opted out cannot be recorded by any combination of project settings.

Frameworks

There is no adapter to install for any of these. SPA route changes are detected by patching the History API, so page views and user journeys are correct without router integration.

Reliability

A tracking script must never break the host page. Every listener is wrapped, rrweb failures are swallowed and logged, and one broken tracker does not stop the others.

• Events leave in bounded batches, not one request per interaction.
• Bodies are gzipped where the browser supports CompressionStream.
• Retries use exponential backoff with full jitter, so a recovering collector is not hit by every browser at once.
• Undeliverable batches are persisted to localStorage and replayed on the next page load, bounded to 20 entries and 6 hours.
• The unload path uses sendBeacon with a fetch(keepalive) fallback, and writes to the outbox first so neither surviving still loses the batch.
• 4xx responses other than 408 and 429 are never retried.
• Mouse movement is sampled at 50 ms and scroll at 150 ms — imperceptible on playback, materially smaller on the wire.

Verify an install

The install page for each website waits for your first event and confirms it live. To check from the browser console instead:

ClikSora.getState().initialised   // true once collection started
ClikSora.getState().recording     // true when rrweb is running