Instrument Your Code

Adding the Sailfish SDK to your backend and frontend gives you the deepest level of visibility — function traces, exceptions, network requests, console logs, and user interactions. This is what powers the AI-activated debugger and enables Sailfish to reconstruct issues without guessing.

Enterprise Setup Overview

Enterprise instrumentation runs in two modes:

1. Local development — Sends telemetry to the Desktop App's local collector (http://localhost:6776/graphql/). No API key required.
2. Staging / Production — Sends telemetry to the Sailfish cloud platform (https://api-service.sailfish.ai/graphql/). Requires your company's API key.

Getting Your API Key

1. Open the Sailfish dashboard
2. Navigate to Settings → API Keys
3. Copy your company's API key

GIT_SHA Environment Variable

Set the GIT_SHA environment variable during your build process so Sailfish can correlate issues with specific deployments:

# Docker build
docker build --build-arg GIT_SHA=$(git rev-parse HEAD) .

# CI/CD pipeline
export GIT_SHA=$(git rev-parse HEAD)

Most Sailfish SDK libraries read GIT_SHA from the environment automatically.

SDK Setup Guides

For detailed, language-specific setup instructions, see the SDK documentation:

Backend

Language	Guide
JavaScript / TypeScript (Node.js)	Setup guide
Python (Django, FastAPI, Flask)	Setup guide
Go (net/http, Gin, Echo, Fiber)	Setup guide
Java (Spring Boot, Quarkus)	Setup guide
C# (.NET)	Setup guide
PHP (Laravel)	Setup guide
Ruby (Rails)	Setup guide

Frontend

Framework	Guide
JavaScript / TypeScript (React, Vue, Angular)	Setup guide

Each language guide has an Enterprise section

Look for the Enterprise Setup section at the bottom of each guide. It covers dual-mode configuration, API key setup, and production deployment.

After Merging Auto-Installation PRs

If you connected GitHub and received Auto-Installation PRs, you may need to make these adjustments:

Backend PRs

1. CORS headers — Allow the X-Sf3-Rid header in your CORS configuration (e.g., add to ALLOWED_HEADERS in Django's settings.py)
2. Lock files — Run your package manager's lock command (poetry lock, npm install, etc.)
3. Domain filtering — If external API calls return 400 errors, add those domains to the domains_to_not_propagate_headers_to parameter

Frontend PRs

1. Domain filtering — Use domainsToPropagateHeaderTo to allowlist only your backend domains, or add problematic external domains to domainsToNotPropagateHeaderTo
2. User identification — Add the identify call where your app authenticates users:

import { identify } from "@sailfish-ai/recorder";
identify(user.email);

3. Domain whitelisting — Allow https://api-service.sailfish.ai/graphql/ so the Report Issue modal works
4. Sanitization — See Privacy & Sanitization below for masking sensitive UI elements

Data Filters

Sailfish lets you filter incoming backend logs using regex rules so noisy or irrelevant log lines never appear in the platform.

Setup

1. Open the Data Filters settings
2. Add one or more Log Filter rules
3. Each rule is a regular expression — any log line matching the pattern will be dropped before storage

Quick link

Open Log Filter Settings →

Examples

Pattern	What it filters
healthcheck|health_check|/health	Health check endpoint logs
DEBUG:	All debug-level log lines
password|secret|token	Lines containing sensitive keywords
^\\[webpack	Webpack build noise

Filters are applied to all incoming backend logs for your company. They do not affect frontend console logs, exceptions, or network requests.

Privacy & Sanitization

Sailfish provides controls for protecting sensitive data in session recordings. Configure these in Settings > Recording > Privacy.

Quick link

Open Privacy Settings →

The sailfishSanitize CSS Class

Add the sailfishSanitize class to any HTML element to completely exclude it and all of its children from session recording data. When an element has this class:

• All text content is redacted — nothing is captured or stored
• All input values are hidden — keystrokes and form data are not recorded
• All click targets within the element report no data — interactions are logged as events but with no content
• Child elements inherit the exclusion — everything inside the sanitized element is protected

<!-- This entire section will be excluded from Sailfish recordings -->
<div class="sailfishSanitize">
  <input type="password" />
  <span>Credit card: 4242-XXXX-XXXX-1234</span>
  <button>Submit Payment</button>
</div>

Use sparingly

Sanitized elements create blind spots in your session recordings. Sailfish cannot capture any debugging context from sanitized regions — errors, user confusion, and interaction issues within them will be invisible. Only apply sailfishSanitize to elements that genuinely contain sensitive data (payment forms, PII fields, medical records). Do not apply it broadly to entire pages or layout containers.