Documentation

Everything you need to integrate BugStash into your application.

Installation

Install the BugStash SDK with your preferred package manager.

Terminal
npm install bugstash

Or with yarn / pnpm:

bash
yarn add bugstash
pnpm add bugstash

Quick Start

Import and initialize BugStash at the root of your application. The SDK injects a lightweight overlay for live pins, bug reports, and screenshot capture.

app.ts
import BugStash from 'bugstash'

BugStash.init({
  projectId: 'your-project-id',
  enableLivePins: true,
  enableScreenshot: true,
  enableAnnotation: true,
  enablePerformance: true,
})
Note: The SDK automatically disables itself in production (environment: 'production'). Set environment explicitly if you want to override this behavior.

Configuration

The init() method accepts a configuration object with these properties:

OptionTypeDefaultDescription
projectIdstringrequiredYour unique project identifier
endpointstringoptionalSelf-hosted only — leave unset to use the BugStash cloud backend
environmentstring'development'One of 'development', 'staging', 'production'. SDK disables in production.
commitHashstringundefinedApplication commit hash for version tracking
enableLivePinsbooleantrueEnable real-time collaborative pin overlay
enableScreenshotbooleanundefinedEnable screenshot capture for reports
enableAnnotationbooleanundefinedEnable annotation drawing tools on screenshots
enablePerformancebooleantrueEnable Core Web Vitals and performance metrics
panelPosition"bottom-right" | "bottom-left""bottom-right"Widget panel position on the page
maxLogsnumberMaximum number of console logs to retain
maxNetworkCapturesnumberMaximum number of network requests to capture
maxBreadcrumbsnumberMaximum number of breadcrumbs to store
userobjectundefinedPre-identify the current user
user.idstringUnique user identifier
user.namestringDisplay name
user.emailstringEmail address

Live Pins

Live Pins let your team drop contextual markers directly on the page. Each pin records the viewport position, DOM selector, page URL, and a comment thread — making it simple to reference an exact element during review.

Pins sync across all connected sessions in real-time via WebSocket. Every team member sees updates instantly.

Bug Reports

The built-in bug report widget captures browser metadata, console logs, network waterfall, breadcrumbs, and a screenshot automatically. Users fill in a title and description, then the report is sent to your dashboard with all context attached.

Screenshots & Annotations

BugStash uses html2canvas to capture a pixel-perfect screenshot of the current viewport. When enableAnnotation is true, users can draw rectangles, arrows, circles, and freehand highlights on a frozen screenshot before submitting a report.

Console & Network Capture

The SDK intercepts console.log, console.warn, console.error, console.debug, and console.info calls. It also tracks all fetch and XMLHttpRequest calls including method, URL, status code, response time, headers, and whether the request failed.

Error Tracking

Uncaught errors and unhandled promise rejections are automatically captured with full stack traces. These are attached to bug reports and pins for context.

Performance Metrics

When enablePerformance is true (default), the SDK collects Core Web Vitals, page load times, memory usage, and resource counts. This data is included in bug reports.

PII Redaction

Built-in redaction for sensitive data. The SDK automatically masks credit card numbers, SSNs, JWT tokens, Bearer tokens, AWS access keys, and password fields in captured logs and network data. Sensitive headers like Authorization and Cookie are also redacted.

BugStash.init(config)

Initialize the SDK and mount the overlay. Must be called once before any other method.

SDK
import BugStash from 'bugstash'

BugStash.init({
  projectId: 'proj_abc123',
  enableLivePins: true,
  enableScreenshot: true,
  user: { id: 'usr_42', name: 'Jane', email: 'jane@co.com' },
})

BugStash.destroy()

Remove all SDK elements from the DOM, close WebSocket connections, restore original console/fetch/XHR functions, and clean up event listeners.

SDK
BugStash.destroy()

BugStash.togglePinMode()

Toggle pin creation mode on or off. When active, clicking on the page creates a new pin at that location. Check status with BugStash.isPinModeActive().

SDK
BugStash.togglePinMode()

// Check if pin mode is currently active
const active = BugStash.isPinModeActive()

User Identity & Auth

Set the current user context so all pins and reports are attributed correctly.

SDK
// Get the currently logged-in user
const user = BugStash.getCurrentUser()

// Login a user
await BugStash.login('jane@co.com', 'password', 'proj_abc123')

// Logout
BugStash.logout()

Logs & Network

Access captured console logs and network requests programmatically.

SDK
// Console logs
const logs = BugStash.getLogs()
BugStash.clearLogs()

// Network captures
const requests = BugStash.getNetworkCaptures()
const failed = BugStash.getFailedNetworkCaptures()
BugStash.clearNetworkCaptures()

Errors & Breadcrumbs

Retrieve tracked errors and user interaction breadcrumbs.

SDK
// Errors
const errors = BugStash.getErrors()
BugStash.clearErrors()

// Breadcrumbs (clicks, navigation, inputs, etc.)
const crumbs = BugStash.getBreadcrumbs()
BugStash.addBreadcrumb({ type: 'custom', message: 'User completed checkout' })
BugStash.clearBreadcrumbs()

Themes & Layouts

The SDK supports multiple UI themes and layout configurations.

SDK
// Themes
const themes = BugStash.getThemes()
BugStash.setTheme('dark')
const currentTheme = BugStash.getCurrentThemeId()

// Layouts
const layouts = BugStash.getLayouts()
BugStash.setLayout('compact')
const currentLayout = BugStash.getCurrentLayoutId()

Authentication

All API requests require a Bearer token. Include it as Authorization: Bearer <token>.

POST/api/auth/register
Request
{
  "name": "Jane Doe",
  "email": "jane@example.com",
  "password": "securepassword",
  "orgName": "Acme Corp"
}
Response 200
{
  "success": true,
  "data": {
    "tokens": { "accessToken": "eyJhbG...", "refreshToken": "..." },
    "user": { "id": "usr_42", "name": "Jane Doe", "role": "owner" }
  }
}
POST/api/auth/login

Returns tokens and user data. If 2FA is enabled, returns requires2FA: true and you must re-submit with a totpCode.

Request
{
  "email": "jane@example.com",
  "password": "securepassword"
}

Pins

GET/api/pins?projectId=...&status=open&page=1

Retrieve all pins for a project. Supports filtering by status and priority, and pagination via page and pageSize.

POST/api/pins

Create a new pin. Include projectId, title, and positional data. The SDK handles this automatically.

Request
{
  "projectId": "proj_abc123",
  "title": "Padding issue on hero section",
  "x": 200, "y": 150,
  "pageUrl": "https://app.example.com",
  "selector": "#hero > .cta-btn",
  "priority": "high"
}
PUT/api/pins/:id/status

Update pin status to open, in_progress, resolved, or closed.

POST/api/pins/check-duplicates

Check for duplicate pins using Jaccard similarity on title, description, error signatures, and page URL.

POST/api/pins/:id/summarize

Generate an AI summary of a pin with its errors, logs, and context.

Reports

GET/api/reports?projectId=...&status=...&severity=...&page=1

List all bug reports for a project. Filter by status and severity.

POST/api/reports

Submit a new bug report with full context. The SDK populates most fields automatically.

Request body fields
{
  "projectId": "...",
  "title": "Dropdown clips on mobile",
  "description": "The navigation dropdown is clipped...",
  "category": "ui",
  "severity": "high",
  "context": { "url": "...", "browser": "...", "os": "..." },
  "consoleLogs": [...],
  "errors": [...],
  "networkCaptures": [...],
  "breadcrumbs": [...],
  "performance": { ... },
  "screenshot": "data:image/png;base64,...",
  "annotation": "data:image/png;base64,..."
}

Webhooks

Register webhook URLs to receive real-time notifications when events occur. All payloads are signed with HMAC-SHA256.

POST/api/webhooks
Request
{
  "url": "https://yourserver.com/webhooks/bugstash",
  "events": ["pin:created", "pin:resolved", "report:submitted"]
}
HMAC Verification: Every webhook includes X-BugStash-Signature and X-BugStash-Event headers. The signature is an HMAC-SHA256 digest of the request body. Webhooks auto-disable after 10 consecutive failures.
Verification (Node.js)
import { createHmac } from &#39;crypto&#39;

function verifySignature(body: string, signature: string, secret: string) {
  const digest = createHmac(&#39;sha256&#39;, secret)
    .update(body)
    .digest(&#39;hex&#39;)
  return digest === signature
}

Data Export

Export your pins and reports as JSON or CSV.

GET/api/export/pins?projectId=...&format=csv

Supported formats: json (default), csv. Also available for reports at /api/export/reports.

Slack Integration

Connect BugStash to Slack for instant notifications. Go to Settings → Integrations → Slack and paste your Incoming Webhook URL. Every new pin and report posts a formatted message with the title, severity, reporter name, and a direct link to the dashboard.

GitHub Integration

Link your GitHub repository to auto-create issues from bug reports. Authorize the BugStash GitHub App and select your target repository. Each report opens a GitHub issue with title, description, browser metadata, and screenshot link.

You can also manually push any existing pin or report to GitHub from the dashboard detail view.