Environments, cookies and data you don't want captured

A handful of settings that belong in your installation rather than in the dashboard. None are required to get started; all of them are worth deciding before you ship.

Tell Gleap which environment it's in

Gleap.setEnvironment("staging"); // "dev" | "staging" | "prod"
Gleap.initialize("YOUR_API_KEY");

The default is prod, so without this every report from every branch looks like it came from production.

The environment travels with the report and shows up in the ticket's data. That's what lets an agent tell a real customer problem from a colleague testing on staging — and it's the first question you'll ask about a report that makes no sense.

Setting the environment doesn't stop non-production traffic reaching your inbox. If you want that separation to be absolute, use a separate Gleap project for staging — its own key, its own inbox, no chance of a test ticket in front of your team.

Cookies

Gleap doesn't use cookies for its session unless you ask it to:

Gleap.setUseCookies(true);
Gleap.initialize("YOUR_API_KEY");

Turn it on if your product spans subdomains and you want one session across them. Leave it off and each subdomain is separate, which means identifying your users on each of them.

Either way, set it before initialize — afterwards is too late.

Keep data out of screenshots and replays

Three CSS classes, applied to your own markup:

<input name="iban" class="rr-mask" />

<div class="invoice-total rr-block">
  € 12,480.00
</div>

• rr-mask — the value is replaced with asterisks.

• rr-block — the element becomes a placeholder of the same size.

• rr-ignore — the element isn't recorded at all.

Password inputs are masked without you doing anything. Everything else is captured as-is unless you mask it, which is deliberate — seeing what a user typed is often what makes a bug report solvable.

To flip that default for the whole app:

Gleap.setReplayOptions({ maskAllInputs: true });
Gleap.initialize("YOUR_API_KEY");

The practical approach: mark the few screens that show real customer data — billing, personal details, anything regulated — rather than masking everything and losing the value of replays entirely.

Turn off page tracking

Gleap.setDisablePageTracking(true);

Gleap records page views by default. Switch it off where the URLs themselves are sensitive — paths that carry record ids or customer names.

A strict content security policy

If your site runs a CSP with nonces, hand Gleap the nonce so its styles and scripts aren't blocked:

Gleap.setCSPNonce("YOUR_NONCE");

The developer docs list the exact directives to allow.

Where these calls belong

All of them go before Gleap.initialize. Called afterwards they either do nothing or apply too late to help — which is the usual reason masking “doesn't work”.