Troubleshoot blocked SDK and network requests

Use this guide when Userorbit fails to load, events do not arrive, or Session Replay uploads fail. Start with a test account and a page that reproduces the issue.

Find the first failing request

Open your browser's developer tools and select Network. Keep Console visible too.
Reload the page and perform the action once. Filter requests for userorbit, then inspect any custom hosts used by your installation.
Find the first failed request in time order. Record its hostname, path, status and the accompanying Console message.
Check the script load first, then initialization/API requests, then analytics or replay traffic. Later failures can be consequences of the first failure.

A loaded SDK script does not prove initialization or event delivery succeeded. Confirm the test activity in the intended Analytics project using Live Events.

Match the symptom to a check

Symptom	What to check
No SDK request	Confirm the snippet or package initialization executes in the browser. Check whether your consent manager or tag-manager trigger is intentionally delaying it.
Browser reports a blocked client request	Retest in an approved clean browser profile. An extension or browser setting may be blocking the request. Keep the original error for comparison.
Console reports a Content Security Policy violation	Read the named directive and blocked URL. Add only the required trusted origin to your application's policy through your normal security review.
Request reaches a host but reports CORS failure	Compare the page origin, destination and any preflight response. CORS response headers must be fixed on the receiving service or proxy.
DNS, certificate or mixed-content error	Check hostname resolution, certificate validity and HTTPS on every requested service.
401 or 403 response	Check the relevant identity, workspace or authorization configuration. A private administrative API key does not belong in your website snippet.
Successful response but no expected event	Verify initialization, the configured action key, project, dates and filters in SDK troubleshooting.
Events arrive but replay does not	Check the recorder script and replay upload requests separately, then review recording eligibility and settings.

Required origins depend on the installed features

For the standard hosted browser SDK, these are useful starting points for inspection:

Origin	Purpose	CSP directive to inspect
`https://cdn.userorbit.com`	Hosted SDK and dynamically loaded recorder/runtime assets	`script-src`, or the more specific script directive named in the violation
`https://api.userorbit.com`	Default browser SDK API host	`connect-src`
`https://replay.userorbit.com`	Hosted replay upload gateway when configured for your workspace	`connect-src`

This table is not a complete replacement CSP. Your installation may also request widget frames, images, fonts or an upload URL returned by the service. Inspect the actual requests and the directive reported by the browser. Preserve your application's existing nonce, hash and origin rules; do not disable CSP or add a blanket wildcard to make an error disappear.

A custom apiHost changes the configured API destination. It does not establish that every SDK asset, widget resource or replay destination moves to that host. For assisted self-hosting, use the endpoint list agreed in your deployment handover and verify it from the customer's browser.

Recheck after a change

Repeat the same test with the intended consent choice and browser configuration. Confirm the script loads, the relevant requests complete, the event reaches the intended project and, if enabled and eligible, the recording can be opened. Changing multiple settings at once makes the cause harder to identify.

Information to include when asking for help

Include your workspace/project, SDK version or script URL, browser/version, environment, test time with time zone, expected result, actual result and a minimal reproduction. Include sanitized request paths, status codes and Console errors. Remove query-string personal data, authorization headers, cookies, tokens and request bodies containing customer information. Use synthetic data where possible.