Install guide
One async script tag. It never blocks rendering, and it does nothing at all until the page has finished its own work.
The snippet
<script async src="https://cdn.replayfy.com/t.js" data-key="pk_YOUR_KEY_HERE"></script>Your real key is on the site's Install screen once you've created a site. It starts with pk_ and is public by design — it identifies which site a recording belongs to and grants no ability to read anything.
Put it in the <head> of every page you want recorded.
Optional attributes
data-sample="0.25" | Record a quarter of sessions. Decided once per visitor and stable for the whole visit, so a sampled session is never half-recorded. |
|---|---|
data-mask-text="all" | Mask every piece of text, not just input values. Replays still show layout and behaviour. |
data-consent="required" | Record nothing until your consent banner calls window.__sr.consent(true). Nothing is buffered in the meantime. |
data-gpc="ignore" | Stop honouring Global Privacy Control. We honour it by default and recommend leaving it that way. |
Content-Security-Policy
If your site sends a CSP, allow our host in both directives. With only script-src the recorder loads and then silently sends nothing, which is a confusing way to spend an afternoon.
script-src 'self' https://cdn.replayfy.com;
connect-src 'self' https://cdn.replayfy.com;Shopify
Online Store → Themes → Edit code → layout/theme.liquid, and paste the snippet just before </head>. Recording stops automatically at checkout URLs, so nothing extra is needed there.
WooCommerce / WordPress
Any header-script plugin works, or add it to your child theme's header.php before </head>.
Single-page apps
Nothing special. Route changes are detected through the History API and recorded as page changes, so a React or Vue app replays as one continuous session across its routes.
Linking a session to a logged-in user
Optional, and privacy-preserving: the identifier is hashed in the browser with a per-site salt before it is sent, so we never receive the value itself.
window.__sr && window.__sr.identify("customer-1234", { label: "Pro plan" });Pass an internal id, never an email address. The optional label is stored as you send it and shown on the session — keep it non-identifying.
Checking it works
Load a page with the snippet, interact for ten seconds or so, then open the site in Replayfy. The first recording usually appears within a minute. If nothing arrives, check the browser console for a CSP violation on connect-src — that is the cause about nine times in ten.