Sessions · Guides

Record only with a yes

Nothing is recorded before the person says yes. Your app asks and keeps the moment; the SDKs carry it to every page, and Sessions refuses a recording without it.

Asking is your part

The SDKs never ask anyone anything. Asking your visitors, as the law where they are requires, and telling them about recording in your privacy policy, is up to you: see our terms for developer services. Sessions makes sure that a person you haven't got a yes from is never recorded.

Keep the moment they said yes

Keep when each person said yes in your own records, for example a nullable recording_consent_at column on your users, and pass it to clientConfig() on every page:

PHP

Sessions::clientConfig(
    subject: $user->id,
    account: $user->team_id,
    consentAt: $user->recording_consent_at, // a DateTimeInterface, or null: not recorded
);

With null, the page's token says not to record, the recorder stays off, and Sessions would refuse a recording under it anyway (403, not-recording). Pass the moment the person said yes, not the time of the request: Sessions uses it to refuse anything recorded before it.

What each page's token says

clientConfig() returns {url, key, env, token, expires_at}. The token is signed with your project's signing key, so a page can't change it. It carries ids and yes-or-no only:

Claim	What it says
`sub`	The person, by your id. Never a name or an e-mail address.
`acct`	Their account, team or workspace, by your id. Optional.
`env`	The environment the page runs in.
`rec`	Whether this page may be recorded: true only with a `consent_at`.
`consent_at`	When the person said yes, in Unix milliseconds.
`mask`	Whether the recording is masked. True unless you pass `mask: false`.
`internal`	One of your own people, kept out of the figures.
`test`	A test person, whose recordings can be read back.
`iat, exp`	When the token was made and when it runs out: 30 minutes by default, an hour at most.

The browser SDK reads the token and records only when it says rec and has a consent_at. A token for another project, or one it can't read, counts as none.

Nothing from before the yes

Sessions refuses a chunk whose first event is more than 5 seconds before consent_at (403, before-consent). The recorder drops that chunk only, and while the browser's clock is behind the moment of the yes, it waits instead of recording. So a tab that was open before the person said yes never sends what it saw before.

When someone takes their yes back

Set their column back to null. From the next response on, their pages carry a token without rec, and the recorder stops until a token with it comes.
To stop on the page where they said no, call recorder.stop() there. What was already recorded, with their yes, is still sent.
If they ask for their recordings to go, erase them from a queued job: Sessions::eraseSubject($user->id). Erasing a person's data has the details.

The journey is not a recording

The journey your server sends doesn't depend on the yes: it holds route names and statuses, never what is on the screen. Each person may still object to it. When someone objects shows how.

Your own people and test accounts

internal: true in clientConfig() marks your staff and demo accounts: their recordings are kept out of the figures. To keep their journey out of stuck points and key flows too, list them in your project's Settings → Your own people.
test: true marks a synthetic person, such as a test or canary account. Only their recordings can ever be read back, to check your masking before you ship.

A recording keeps the marks its first token gave it. A token with another test mark, or another mask, starts a new recording.