Install the tag on a website

The browser tag measures what real visitors experience on your website. It is one script, served by your own install, with no CDN and no third party involved. It reads what the browser has already measured, then sends it in batches.

Create an application

Each website is an application, with its own key and its own numbers. Go to Launchpad → Install → Web application and press + New application. Choose that it is a website. You choose the kind when you create the application, and it decides which pages the application gets. A mobile app is a separate application. See React Native and Expo apps.

Paste the tag

The Install page shows the tag for the application you pick:

<script src="https://your-install/rum.js" data-key="rum_xxxxxxxx" defer></script>

Put it first in the <head>, before other scripts, so it sees early errors and every resource the page loads. It does not block rendering.

Application settings → Tag to paste offers a second form: a small inline loader. It writes the application's sampling rate and traced origins into the tag, and passes a CSP nonce on to the script it creates. It also defines rum() straight away and queues calls made before the script has loaded. Use the inline form if your code calls rum(…) early in the page. With the plain tag, rum exists only once rum.js has loaded.

What it measures

• Page loads: redirect, DNS, TCP, TLS, request, time to first byte, download, DOM interactive, DOMContentLoaded and load. Single-page app route changes count as views of their own.
• Core Web Vitals: LCP (with the selector of the element), INP, CLS, FCP, FID and TTFB, plus long tasks.
• Resources: up to 150 per page, with phases, sizes, protocol and cache hits.
• API calls: XHR and fetch, with method, URL, status, duration and size.
• Errors: uncaught errors, unhandled promise rejections, failed script, image and stylesheet loads, and optionally console.error.
• Behaviour: clicks on the nearest interactive element, rage clicks (three or more clicks within 1.2 seconds and 40 pixels), dead clicks (no DOM or URL change within one second), scroll depth, and form-field changes without their values.
• Sections: how long each marked part of a page was on screen, and how much of each video was played. See Pages, attention heatmaps and resources.

Attributes on the script tag

An empty attribute counts as not set. Several of these are also settings of the application, where you can change them without touching the page. See Application settings.

The JavaScript API

rum('identify', 'user-123', { plan: 'pro' });          // tie the session to a user
rum('event', 'purchase', 24990, { currency: 'EUR' });  // a business event with a value
rum('error', new Error('handled'));                    // report a handled error
rum('page', 'Checkout');                               // a manual view change
rum('flush');                                          // send now
rum(function (api) { console.log(api.session()); });   // get at the agent

Custom events are what funnels can match, beside page paths. window.RUM is the same API object.

Sessions, storage and cookies

A session ends after 30 minutes without activity, or after the timeout set for the application (1 to 1440 minutes). A session never lasts longer than four hours.

The tag sets no cookies. It keeps a random visitor id and the current session in the site's own local storage (_rum_vid, _rum_sid), plus the user id if you call identify (_rum_uid). Beacons are sent without credentials, as text/plain, so they need no CORS preflight. If the collector cannot be reached, the tag retries with a growing back-off of up to a minute.

Allowed origins

An application key sits in page source, so anyone can read it. To stop other sites sending data in your name, list your origins under Application settings → Allowed origins, for example shop.example.com,*.example.com. With an empty list any origin may send. Once a list exists, a beacon from another origin is refused, and the tag prints the reason in the browser console.

Text for your privacy policy

Under the tag, the Install page writes a privacy-policy paragraph from this application's own settings. It covers what is recorded, that no cookies are set, that the IP address is not stored, whether session replay is on, and how long data is kept. When you change replay, retention or the attributes read from the page, the text changes with them. See Privacy and data protection.

Did it work

Open the site, then check Frontend for the application. Its live card shows active sessions from the last five minutes. If nothing arrives, add data-debug="1" and read the browser console. The tag says when measurements are not reaching the collector, and why: for example the origin is not allowed, or the key is unknown.