Authentication
Every tracker instance is authenticated with an API key, scoped to a production or sandbox environment.
API keys
Pass your key via the apiKey field when constructing a BodyTracker. Keys come in two flavors, distinguished by prefix:
bt_live_...— production keys. These track real sessions and count against your plan's usage.bt_test_...— sandbox keys. Safe for local development and CI; sessions are not billed or persisted long-term.
import { BodyTracker } from "@bodytracker/sdk"; const tracker = new BodyTracker({ apiKey: "bt_live_51H8x...redacted",});Never expose live keys in client-side bundles
A bt_live_ key embedded in a browser bundle is visible to anyone who opens dev tools. For production apps, mint short-lived tokens from your backend — proxy the initial handshake through your own server, which holds the real key, and hand the browser a scoped token instead. Sandbox keys are lower risk but should still stay out of public repos.
Environments
The optional environment field controls which backend your tracker talks to — "production" (the default) or "sandbox". It should match your key type: pairing a bt_test_ key with "production" (or vice versa) causes init() to reject.
import { BodyTracker } from "@bodytracker/sdk"; // Sandbox: safe for local development, uses bt_test_ keys,// and never bills or writes to production analytics.const tracker = new BodyTracker({ apiKey: "bt_test_82Vd0...redacted", environment: "sandbox",});Configuring the client
apiKey is the only required field. Everything else in BodyTrackerConfig is optional and lets you pin a specific camera, restrict which activities are detected, tune motion smoothing, and set a locale for formatted output:
import { BodyTracker } from "@bodytracker/sdk"; const tracker = new BodyTracker({ apiKey: "bt_live_9Fk2q...redacted", environment: "production", cameraDeviceId: "e3f1c9b2...", activityTypes: ["standing", "walking", "running"], smoothing: { enabled: true, windowSize: 5 }, locale: "en-US",});Rotating keys
If a key is ever exposed — committed to a public repo, leaked in a client bundle, or simply due for routine rotation — revoke it and generate a replacement from the account dashboard. Revoking a key takes effect immediately; any tracker instance still using it will fail on its next request, so roll out the new key to your deployments before revoking the old one.