The UMAP360 Web SDK (@umap360/sdk-web) is a small, dependency-free browser client that batches, retries, and enriches events for you, then sends them to the same POST /v1-batch endpoint you can call directly via the REST API. On top of that endpoint it adds automatic pageview tracking, identity persistence, attribution capture, and privacy controls.

You don't need the SDK to send events

The REST API is the source of truth and works today with any HTTP client. The SDK is a convenience layer for browser apps — reach for it when you want batching, retries, and automatic context collection without writing them yourself.

Before you start

You'll need a UMAP360 account and a write key. No project yet? Sign up at app.umap360.com. Then copy your write key from Settings → API Keys, and your ingestion endpoint (apiHost) from Settings → SDK Setup — which also shows a ready-made install snippet.

Install

npm

npm install @umap360/sdk-web
# or: yarn add @umap360/sdk-web
# or: pnpm add @umap360/sdk-web
import umap360 from '@umap360/sdk-web';

umap360.init({
  writeKey: 'uk_live_YOUR_WRITE_KEY',
  apiHost: 'https://YOUR_PROJECT_REF.supabase.co/functions/v1',
});

The package ships an ES module, a CommonJS build, and TypeScript types, so the same import works in any modern bundler (Vite, webpack, esbuild, Next.js, …).

CDN (script tag)

If you don't use a bundler, load the pre-built bundle from a CDN. The UMD build exposes the SDK on the global umap360.default:

<script src="https://cdn.jsdelivr.net/npm/@umap360/sdk-web@1/dist/umap360.min.js"></script>
<script>
  // The UMD global is the module namespace — the client is `umap360.default`.
  const umap = window.umap360.default;
  umap.init({
    writeKey: 'uk_live_YOUR_WRITE_KEY',
    apiHost: 'https://YOUR_PROJECT_REF.supabase.co/functions/v1',
  });
</script>

Write keys are safe in the browser

A write key (uk_live_) can only send events — it can't read your data or manage your account, so it's designed to be embedded in client-side code. Keep read and admin keys server-side. See Authentication.

The two required options

init() needs exactly two things; everything else has a sensible default (see the API reference).

OptionRequiredWhat it is
writeKeyyesYour uk_live_ write key from Settings → API Keys.
apiHostyesYour project's edge-function base URL, e.g. https://YOUR_PROJECT_REF.supabase.co/functions/v1 — copy it from Settings → SDK Setup (the SDK appends /v1-batch).

HTTPS is required

apiHost must be https:// in production — init() throws on a plain-http:// host, so end-user PII never crosses the wire in cleartext. Local development hosts (localhost, 127.0.0.1, [::1], 192.168.x.x, 10.x.x.x, *.local) may use http://.

Use it in a framework

The SDK is framework-agnostic, but it touches window and document, so initialise it in the browser only — never during server-side rendering. In the Next.js App Router, do that from a Client Component mounted once near the root:

'use client';

import { useEffect } from 'react';
import umap360 from '@umap360/sdk-web';

export function Analytics() {
  useEffect(() => {
    umap360.init({
      writeKey: process.env.NEXT_PUBLIC_UMAP_WRITE_KEY!,
      apiHost: process.env.NEXT_PUBLIC_UMAP_API_HOST!,
    });
  }, []);

  return null;
}

init() is idempotent — a second call is a no-op — so a remount won't double-initialise. In a plain bundler app without SSR (Vite, CRA), there's no SSR guard to worry about — just import umap360 and call init() once in your entry module.

Identify and track from your app

The default export is a shared singleton — import it anywhere and call its methods; no need to thread it through props or context:

'use client';
import umap360 from '@umap360/sdk-web';

export function SignupButton() {
  function onSignup(userId: string, email: string) {
    umap360.identify(userId, { email });          // tie events to the known user
    umap360.track('Signed Up', { plan: 'pro' });  // a custom event
  }
  return <button onClick={() => onSignup('user_456', 'a@example.com')}>Sign up</button>;
}

Call umap360.reset() on logout to start a fresh anonymous identity. To auto-capture link/button clicks without writing handlers, pass trackClicks: true to init() (see the reference).

Verify it's working

With the defaults, the SDK tracks the first pageview automatically. Open Events in the dashboard and you should see a page event within a few seconds. To force a send immediately (for example in a test), await umap360.ready() and then umap360.flush(). If nothing arrives, set debug: true in init() and check the console — a 401 means the write key or apiHost is wrong.

Versioning & upgrading

This page documents @umap360/sdk-web 1.5.1 (the current npm release). Pin a major range — @umap360/sdk-web@^1 (npm) or @1 (CDN) — to get non-breaking updates automatically; a breaking change bumps the major. Release history is on npm.

Next steps

  • API reference — every method, every configuration option, and the consent + privacy controls.
  • Event ingestion — the wire format each SDK method maps to.
  • Guides — identity, attribution, and consent patterns.

Last updated 2026-06-09

We use cookies for analytics — to understand how visitors use UMAP360 and improve the product. Essential cookies (session, forms) always run; analytics cookies wait for your call. See cookie policy.