In a hurry? If someone has already created the workspace and sent you an
bc_live_… key and a project id, skip to the
Web SDK page — that is the whole integration.
What BugCatch needs from you
Three values, and every integration on this site uses the same three. Sections 1 to 3 below are where each one comes from.
| Value | Looks like | Where it comes from |
|---|---|---|
| API base | https://api.bugcatch.sphoro.com |
Fixed. The same for every customer on the hosted service. |
| Project id | cly8f2k0x0001… |
Created in step 2. Decides which project reports land in. |
| API key | bc_live_a1b2c3… |
Created in step 3. Belongs to the workspace, not to you. |
The API key is publishable. It ships in your page source and anyone who views source can read it — that is by design, and it is why the key can only file reports and read the ones the browser holding it filed. It cannot list your bugs, read another reporter's thread, or reach anything in the dashboard. Do not reuse it as a server credential and do not treat a leak of it as a breach. See what the key can do.
1. Create your workspace
A workspace is your company. It owns the plan, the members, the API keys and the projects. You will make one, once.
-
Sign up
Go to app.bugcatch.sphoro.com and create an account with your work email. A six-digit code is emailed to that address; type it back to confirm you can read the mailbox.
-
Bind an authenticator — this is not optional
The moment the code is accepted you are asked to scan a QR code with an authenticator app (1Password, Authy, Google Authenticator, anything TOTP). There is no way past this screen and no window in which the account exists without a second factor.
Save the recovery codes it gives you. They are shown once. Losing the phone without them means losing the account.
-
Name the workspace
You land in the dashboard on the Free plan: one project, two members, seven days of retention. Nothing to pay and no card to enter.
There is no self-serve upgrade button. Plans are set by staff, or by a single-use code the workspace owner redeems. If you need Team or Enterprise, talk to us — you will not find a card form, because there isn't one.
What each plan actually gives you
| Free | Team | Enterprise | |
|---|---|---|---|
| Price | $0 | $19 / member / mo + $9 per project past the first | Custom |
| Projects | 1 | 25 | Unlimited |
| Members | 2 | 20 | Unlimited |
| Retention | 7 days | 90 days | 365 days |
| Encrypted at rest | — | Yes | Yes |
| AI analysis | — | Yes | Yes |
| Automation rules | — | Yes | Yes |
| Database data sources | — | Yes | Yes |
Capture, the widget, the extension, trackers, the REST API and the reporter's thread are on every plan, Free included. So is retention — the window above is enforced by a job that deletes, not merely a number on a page.
Two notes on the paid rows. AI analysis is bring-your-own-key: the plan opens the door, and an Anthropic key in Settings → Integrations → AI Provider walks through it. Automation rules can be configured on any plan and simply do not fire below Team, so you can set them up while evaluating and see exactly what you would get.
2. Create a project
A project is one product, or one environment of one product. Reports land in exactly one, and it is the unit that carries integrations, automation rules and the reporter sign-in setting.
-
Open Projects
In the dashboard sidebar, go to Projects → New project.
-
Give it a name and a key
The name is for humans. The short key (say
WEB) prefixes each report's reference, so a bug reads asWEB-3F2A9B01in a standup rather than as a UUID. -
Copy the project id
Open the project, then Project Settings → General. Project ID is listed under the form, with a copy button beside it. This is the
projectIdevery snippet on this site asks for — not the short key, and not the name.
One project per environment, or one for all of them? One project, and tag
the environment through metadata. Separate projects mean separate
knowledge bases and separate duplicate detection, so a staging bug and the
production bug it predicts never meet. The exception is when different people
should see them — access is granted per project.
3. Issue an API key
The key authenticates the SDK, the extension and the REST API. It belongs to the workspace and works for every project in it.
-
Open the keys screen
Workspace Settings → API Keys → Create key.
-
Name it after where it will live
marketing-site,ios-webview,ci. When you revoke one in a year, the name is the only thing that tells you what breaks. -
Copy the secret now
It is shown once. Only a hash and the first few characters are stored, so there is no screen anywhere that can show it to you again — losing it means revoking and issuing another.
bc_live_4f9a2c1e8b7d0a63f5e2c9b184d7a0e3
└──┬──┘└───────────────┬───────────────┘
│ └─ 32 random hex characters
└─ always this prefix; there is no test-mode key
Revoking is immediate and total. Every site, app and script using that key
stops filing the moment you revoke it, with a 401. Issue the
replacement, deploy it, then revoke the old one — in that order.
4. Choose how reports get filed
Four ways in. They are not alternatives to each other — most teams end up running two, because the person who finds a bug is sometimes a developer and sometimes a customer.
Web SDK →
One script tag in your product. Your users get a Report a bug button, and the report arrives with console, network and environment already attached.
For: customers and non-technical staff. ~4 kB, nothing to install.Browser extension →
Works on any site, including localhost and staging behind a login. Screenshot with annotation, screen recording, and Rewind — the last two minutes, captured after the bug.
For: your own QA, support and engineers.Recording links →
A URL you send to anyone. They record, describe the problem and submit — no account, no extension, nothing embedded in your product.
For: a customer on the phone, right now.REST API →
File reports over HTTP from anywhere — a mobile app, a CI job, a crash handler, a support tool. The same endpoints the SDK itself calls.
For: anything that is not a web page.Whichever you pick, connect your tracker afterwards so the bug lands where your team already works — see Integrations.
5. Quickstart: first report in 5 minutes
The shortest honest path. Paste this into any HTML page you can load in a browser — your product, or a scratch file on your desktop — with your own two values swapped in.
<!-- Pin the version. Without one the CDN serves whatever is latest, so a
future release changes behaviour on a site nobody redeployed. -->
<script src="https://unpkg.com/@sphoro/bugcatch-web-sdk@0.13.1/dist/bugcatch.umd.js"></script>
<script>
BugCatch.init({
apiBase: 'https://api.bugcatch.sphoro.com',
apiKey: 'bc_live_…', // Workspace Settings → API Keys
projectId: '…', // Project Settings → General
});
</script>
Load the page. You should now be able to work through this list:
- A Report a bug button sits in the bottom-right corner.
- Clicking it opens a panel with a title, a description and an attach row.
- Filling in a title and pressing Send report closes it with a confirmation.
- The report is in the dashboard within a second or two, under the project you named.
- Opening it shows a Console and a Network tab with what the page was doing.
If it did not appear, the answer is almost certainly in SDK troubleshooting — every failure mode that page lists writes something to the browser console.
6. What to do next, in order
A first report proves the wiring. These are the things that make it useful, roughly in the order they pay off.
-
Tell BugCatch who is reporting
One call —
BugCatch.identify({ email }). It threads a person's reports together, and it is the address the "your issue is fixed" mail goes to. Without it every report is anonymous and nobody hears back. How → -
Connect your tracker
Jira, GitHub, Linear or Slack, per project, about two minutes each. Then the bug arrives where your team already looks instead of in a second place they have to remember. How →
-
Get the extension to the people who triage
Support and QA file better reports with it than with the widget, because Rewind catches the thing that already happened. How →
-
Decide what must never leave the browser
Credentials in URLs are stripped before they are ever buffered, with no configuration. Anything else specific to your product — an internal endpoint, a customer identifier — is a
beforeSendfilter and a server-side redaction rule. How → -
Close the loop
Reporters see status changes and replies inside your app, and can write back with files and voice notes. It is on by default once
identify()has an email — mostly this step is deciding whether to render it yourself. How →
Hosts and endpoints
| Host | What it is |
|---|---|
api.bugcatch.sphoro.com |
The API. Everything under /ingest/ is what your integration talks to. |
app.bugcatch.sphoro.com |
The dashboard — where your team triages, and where every setting on this page lives. |
app.bugcatch.sphoro.com/track |
The reporter portal. Someone who filed a bug signs in by email to check on it. |
bugcatch.sphoro.com |
This site. |
Nothing to allowlist. The /ingest/ routes accept any origin,
because the SDK runs on your site and we cannot know its address ahead of time.
That is safe because those routes authenticate with a header and never a cookie.
You do not need to send us your domain, and there is no CORS setting to fill in.
Glossary
| Term | Means |
|---|---|
| Workspace | Your company. Owns the plan, members, API keys and projects. |
| Project | One product or environment. Reports land in exactly one. |
| Member | Someone on your team with a dashboard account. Counts against the plan. |
| Reporter | Whoever filed the bug. Needs no account and never sees your dashboard. |
| Report / bug | One filed problem, with its context, attachments and thread. |
| Watch token | Returned when a report is filed. Lets that browser follow that report — and nothing else. |
| Rewind | The extension's rolling two-minute buffer, saved after the bug appears. |
| Recording link | A public URL anyone can file through, with no account and no install. |
Still stuck?
Every answer here describes what the product actually does today. If something behaves differently, that is worth telling us about — it means the page is wrong.
- Support
- support@sphoro.com
- Security
- info@sphoro.com
- Talk to us
- Book 20 minutes