IDebug is experimental. Prefer enabling only in development.
Getting startedConfiguration

Configuration

All server SDKs share the same config shape (from @idebug/core).

interface IDebugConfig {
  enabled: boolean; // default false
  performance: boolean; // default true
  appName: string | null;
  basePath: string; // default '/__idebug'
  maxSessions: number; // default 200
  maxEventsPerSession: number; // default 500
  maxTotalEvents: number; // default 10_000
  redactKeys: string[]; // merged with built-in secret keys
  db?: boolean | DbMonitorConfig; // default on when enabled — see @idebug/db
  // Security (defaults maximize local-dev safety)
  accessToken: string | null; // default null — set a secret when possible
  hostCheck: boolean; // default true — Host must be localhost/loopback
  allowedHosts: string[]; // extra Host values (e.g. myapp.local)
  localRemoteOnly: boolean; // default true — peer must be loopback
}

See Security posture for DNS rebinding, bind guards, and tokens.

Express

import IDebug from '@idebug/node';
 
IDebug.configure({
  enabled: process.env.NODE_ENV !== 'production',
  appName: 'billing-api',
  performance: true,
  db: true, // wrap clients with instrumentPrisma / instrumentDrizzle / …
  basePath: '/__idebug',
  maxSessions: 100,
  redactKeys: ['ssn', 'taxId'],
  accessToken: process.env.IDEBUG_TOKEN ?? null,
  // hostCheck: true,
  // localRemoteOnly: true,
});

NestJS

IDebugModule.forRoot({
  enabled: process.env.NODE_ENV !== 'production',
  appName: 'billing-api',
  performance: true,
  db: true,
  accessToken: process.env.IDEBUG_TOKEN ?? null,
});
// `register` is an alias of `forRoot`

React

import { start } from '@idebug/react';
 
start({
  enabled: true,
  overlay: true,
  maxEvents: 1000,
  captureFetch: true,
  captureXhr: true,
  captureErrors: true,
  captureNavigation: true,
  redactKeys: ['sessionToken'],
});

Safety defaults

SettingDefaultNotes
enabledfalseMiddleware no-ops; wrappers still call original functions
hostChecktrueBlocks non-localhost Host (DNS rebinding)
localRemoteOnlytrueBlocks non-loopback TCP peers
accessTokennullOptional; send Bearer / X-IDebug-Token / ?idebug_token=
performancetrueAdds timings when enabled
dbon when enabledQuery monitor; pass false to disable. See @idebug/db.
Redactiononauthorization, password, token, … → ***
Production—Prefer enabled: process.env.NODE_ENV !== 'production' + bind 127.0.0.1

Ring buffer

When caps are exceeded, oldest sessions/events are evicted deterministically. Tune maxSessions, maxEventsPerSession, and maxTotalEvents for chatty apps.