# Configuration reference


You can customize the Flare client using `flare.configure()`. Call it after `flare.light()`:

```js
import { flare } from '@flareapp/js';

flare.light('YOUR PROJECT KEY');

flare.configure({
    stage: 'production',
    maxGlowsPerReport: 50,
});
```

## Options

### General

| Option              | Default | Description                                                                                                                                                                                                                                                                                 |
|---------------------|----------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `stage` | `''` | Environment identifier (e.g. `'production'`, `'staging'`). |
| `version` | `''` | Application version string (e.g. `'2.1.0'`). Sent as `service.version` in reports. |
| `sourcemapVersionId` | `''` | Tells Flare which uploaded sourcemap resolves this build's stack traces. The [Vite and Webpack plugins](/docs/javascript/errors/sourcemaps) inject it at build time, so you only set it yourself when you upload sourcemaps another way. |

### Error reporting

| Option              | Default | Description                                                                                                                                                                                                                                                                                 |
|---------------------|----------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `maxGlowsPerReport` | `30` | Maximum number of [glows](/docs/javascript/data-collection/adding-glows) (breadcrumbs) attached to each report. |
| `ingestUrl` | `https://ingress.flareapp.io/v1/errors` | Custom endpoint for error reports. |
| `reportBrowserExtensionErrors` | `false` | Whether to report errors caused by browser extensions. See [reporting errors](/docs/javascript/errors/reporting-errors). |
| `debug` | `false` | Enable debug logging in the browser console. |
| `urlDenylist` | `DEFAULT_URL_DENYLIST` | A `RegExp` tested against query-string parameter names. Matching values are redacted from the `url.full` attribute and other URL-derived fields. Custom patterns are merged with the built-in denylist by default. |
| `replaceDefaultUrlDenylist` | `false` | When `true`, `urlDenylist` replaces the built-in denylist instead of extending it. |
| `sampleRate` | `1` | Number between `0` and `1` controlling what fraction of errors are reported. `0.5` means roughly 50% of errors are sent to Flare. Applies to `report()`, `reportMessage()`, and unhandled rejections. |
| `beforeEvaluate` | `(error) => error` | Hook called before an error is processed. Can be async. Returns the error unchanged by default. See [client hooks](/docs/javascript/errors/client-hooks). |
| `beforeSubmit` | `(report) => report` | Hook called before a report is sent. Can be async. Returns the report unchanged by default. See [client hooks](/docs/javascript/errors/client-hooks). |

### Logging

| Option              | Default | Description                                                                                                                                                                                                                                                                                 |
|---------------------|----------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `enableLogs` | `false` | Opt in to [structured logging](/docs/javascript/logs/introduction). No logs are recorded or sent while `false`. |
| `minimumLogLevel` | | Drop logs below this [severity](/docs/javascript/logs/levels). When unset, all levels are sent. |
| `serviceName` | | Service name attached to log records (sent as `service.name`). |
| `maxLogBufferSize` | `100` | Maximum number of buffered log records before a flush is triggered. |
| `logFlushIntervalMs` | `5000` | Milliseconds after the first buffered log before the batch is flushed. |
| `logFlushMaxBytes` | `800000` | Approximate buffered log payload size that triggers a flush. |
| `keepaliveMaxBytes` | `60000` | Byte budget for the unload (`keepalive`) log flush. Records that don't fit are dropped. |
| `logsIngestUrl` | `https://ingress.flareapp.io/v1/logs` | Custom endpoint for log batches. |

### Tracing

| Option              | Default | Description                                                                                                                                                                                                                                                                                 |
|---------------------|----------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `enableTracing` | `false` | Turn on tracing: page loads, navigations, `fetch`/`XMLHttpRequest` requests, and manual spans. No spans are recorded while `false`. See [how tracing works](/docs/javascript/tracing/how-tracing-works). |
| `tracesSampleRate` | `1` | Number between `0` and `1` controlling what fraction of traces are sent. Values outside that range are clamped. Ignored when `tracesSampler` is set. See [sampling](/docs/javascript/tracing/sampling). |
| `tracesSampler` | | A function that decides sampling itself instead of using a fixed rate. Takes precedence over `tracesSampleRate` when set. See [sampling](/docs/javascript/tracing/sampling). |
| `tracesIngestUrl` | `https://ingress.flareapp.io/v1/traces` | Custom endpoint for trace batches. |
| `idleTimeout` | `1000` | Milliseconds with no open child spans before a page load or navigation root span closes. |
| `finalTimeout` | `30000` | Milliseconds from a page load or navigation root's start before it closes regardless of activity. This is a hard upper limit that applies even when `idleTimeout` keeps resetting. |
| `childSpanTimeout` | `15000` | If a child span stays open this many milliseconds, its root closes anyway, even with other spans still open. This is a second limit that applies alongside `idleTimeout`. |
| `spanFlushIntervalMs` | `5000` | Milliseconds after the first buffered span before the batch is flushed. |
| `spanFlushMaxBytes` | `800000` | Approximate buffered span payload size that triggers a flush. |
| `maxSpanBufferSize` | `100` | Maximum number of buffered spans before a flush is triggered. |
| `maxSpansPerTrace` | `1024` | Maximum number of spans recorded for one trace. Once a trace reaches this limit, further spans started in it are not recorded. See [how component profiling works](/docs/javascript/profiling/how-component-profiling-works) for a case where this matters. |
| `maxAttributesPerSpan` | `128` | Maximum number of attributes kept on one span. Further attributes are dropped. |
| `maxEventsPerSpan` | `128` | Maximum number of events kept on one span. Further events are dropped. |
| `maxAttributesPerSpanEvent` | `128` | Maximum number of attributes kept on one span event. Further attributes are dropped. |

### Customizing the URL denylist

The default `urlDenylist` redacts query-string values for the following sensitive parameter names: `password`, `passwd`, `pwd`, `token`, `secret`, `authorization`, `auth`, `bearer`, `oauth`, `credentials`, `cookie`, `api_key`, `private_key`, `session`, `csrf`, `xsrf`, `pin`, `ssn`, `card_number`, and `cvv`. Path and hash segments are left untouched.

A custom `urlDenylist` is **merged** with the built-in denylist by default, so you won't accidentally lose redaction for sensitive terms like `password` or `token`:

```js
flare.configure({
    urlDenylist: /myCustomParam|internalId/i,
});
```

If the built-in denylist matches too aggressively for your use case, you can replace it entirely:

```js
flare.configure({
    urlDenylist: /onlyThisParam/i,
    replaceDefaultUrlDenylist: true,
});
```