Running it

PeekInside Cloud

Record requests from your staging and production servers, encrypted on the server before they're sent and decrypted in your browser.

For servers, PeekInside sends what it records to PeekInside Cloud. It's encrypted on your server before it's sent, and decrypted in your browser.

Set it up#

  1. Create an account and your organization. Each organization gets a 7-day trial.

  2. Create a project. PeekInside shows its API key once: copy it.

  3. Set the key in your server's environment:

    PEEKINSIDE_API_KEY=pik1.p…

  4. Deploy. No code changes: PeekInside.attach(app) sees the key, switches to cloud mode and turns the local dashboard off.

Use one project per app, and label each environment with PEEKINSIDE_ENV (such as staging): the label is shown with every request.

Encryption#

  • On your server. Each project has a key pair, created in your browser. The API key contains the project's public key, and the SDK encrypts every request with it (ECDH P-256, HKDF-SHA-256, AES-256-GCM) before it leaves your server. The API key can send requests, but it can't read them.
  • What stays readable. PeekInside Cloud stores URLs, headers, bodies, queries, logs and exceptions only as ciphertext. In the clear it keeps what charts, filters and plan limits need: when a request happened, its method, status, duration and sizes, the environment name, and its counters (queries, slow queries, N+1 statements, outgoing calls, log lines, exceptions); for an exception, when it happened, the environment, and whether it was handled or fatal. Your browser decrypts the rest.
  • Standard protection (the default). Signing in with your email code unlocks a new browser, so PeekInside keeps your account key sealed under a key its servers hold, stored apart from your data.
  • Advanced protection. Turn it on from the Security page, and only your own browsers, passkeys and recovery key hold your account key: end-to-end encryption.

Delivery#

  • Off the request path. Requests are queued and sent in batches every second, of at most 100 records and 4 MB. If PeekInside Cloud can't be reached, batches are retried with backoff; the queue is bounded, so memory stays flat.
  • Crashes are encrypted and sent right away. If PeekInside Cloud can't be reached, the encrypted batch is saved and sent when the app starts again.
  • Short-lived processes (scripts, serverless functions) should call await peekInside.flush() before exiting.

Plans and data#

PeekInside Cloud costs $10 a month per organization, after a 7-day trial. Requests and exceptions are kept for 14 days. See pricing.