---
title: "Usage reporting | FoxAuth"
description: "Every field of the daily anonymous report a FoxAuth server sends, and how to turn it off."
canonical: "https://foxauth.dev/docs/reference/telemetry/"
lastmod: "2026-10-29T11:10:24+03:00"
---
Usage reporting

Documents unreleased changes made after v1.4.0 (commit 4af4e42a)

This page is generated from the main branch. The published image
ghcr.io/redfox-soft/oauth-server-ts:latest is v1.4.0
and may not have everything listed here.

Once a day, a FoxAuth server sends one small report to the FoxAuth maintainers. The report says which version the server runs, on what, with which features on, and roughly how big it is. The maintainers use it to decide what to keep, what to fix first and what nobody uses any more.
Reporting is on by default. Nothing in a report names you, your projects, your applications or your users. A report that cannot be delivered is not an error: the server carries on and tries again the next day.
Turning it off
In the console: Settings → Integrations → Usage reporting. The change applies at once, without a restart. This setting is the only switch.
The console card under the switch shows the exact report the server last sent, so you can check what left it.
The addresses that attack a server are reported separately, hourly, under a switch of their own: see Attack reporting.
Where it goes
Reports go to https://api.foxtrust.dev/v1/foxauth/usage, run by the FoxAuth maintainers. The receiver does not store the address a report comes from, and keeps reports for 13 months.
Every field
This is format 1. Counts are never exact: each is sent as one of these ranges: 0, 1, 2-10, 11-100, 101-1000, 1001-10000, 10001-100000, 100001+.
FieldWhat it saysValues
formatThe version of this report format.1
instanceIdA random identifier this server generated for itself and keeps in its database. It is derived from nothing, so it says nothing about who runs the server; it only lets reports from one server be grouped.a UUID
foxauth.versionThe FoxAuth release this server runs. Left out when the package manifest cannot be read.a version such as 1.3.0
runtime.bunThe Bun version this server runs on.a version such as 1.3.4
runtime.osThe operating system.a Node.js platform name such as linux, darwin or win32
runtime.archThe processor architecture.a Node.js architecture name such as x64 or arm64
runtime.containerWhether the server appears to run in a container. A best guess from the usual container markers.true or false
storageWhich database the server stores its data in.mongodb or postgres
features.<setting>Whether a feature setting is on. Only the on/off of the settings listed as reported is sent, never a value.true or false
size.projectsHow many projects the server holds, the administrators' own project included.one of 0, 1, 2-10, 11-100, 101-1000, 1001-10000, 10001-100000, 100001+
size.applicationsHow many applications are registered across all projects.one of 0, 1, 2-10, 11-100, 101-1000, 1001-10000, 10001-100000, 100001+
size.apisHow many APIs (protected resources) are declared.one of 0, 1, 2-10, 11-100, 101-1000, 1001-10000, 10001-100000, 100001+
size.administratorsHow many administrator accounts exist.one of 0, 1, 2-10, 11-100, 101-1000, 1001-10000, 10001-100000, 100001+
size.monthlyActiveUsersPeople who received tokens this calendar month, summed over projects.one of 0, 1, 2-10, 11-100, 101-1000, 1001-10000, 10001-100000, 100001+
day.dateThe UTC day the day figures below describe: the day before the report. Left out when the server has no figures for that day yet, for example on its first day.a date, YYYY-MM-DD
day.tokens.<grant>How many token responses that grant type produced that day. A grant type with none is left out. Left out when the server has no figures for that day yet.one of 0, 1, 2-10, 11-100, 101-1000, 1001-10000, 10001-100000, 100001+; grant names are authorization_code, client_credentials, refresh_token, device_code, ciba, jwt_bearer, token_exchange
day.serverErrorsDefects the server recorded that day: 5xx responses and faults in background work, counted whether or not its error store is on. Left out when the server has no figures for that day yet.one of 0, 1, 2-10, 11-100, 101-1000, 1001-10000, 10001-100000, 100001+
Never sent
No name, email, hostname, issuer URL or network address. No identifier of a project, an application or a person. No value of any setting: only whether the features below are on or off.
Settings whose on/off is reported
authorization.allowOmittingSingleRegisteredRedirectUri: Allow omitting a single registered redirect_uri
pkce.required: Require a PKCE code challenge
par.enabled: Enable PAR (RFC 9126)
par.allowUnregisteredRedirectUris: Allow unregistered redirect_uris via PAR
dpop.enabled: Enable DPoP (RFC 9449)
dpop.requireNonce: Require DPoP nonce
introspection.enabled: Enable Token Introspection (RFC 7662)
jwtIntrospection.enabled: JWT introspection responses (RFC 9701)
responseMode.jwt.enabled: Enable JARM
fapi.enabled: Enable FAPI behaviours
ipsieSl1.enabled: Enforce the IPSIE SL1 profile
clientAuth.issuerOnlyAudience: Accept client assertions audienced at the issuer only
clientCredentials.enabled: Enable client_credentials grant
tokenExchange.enabled: Enable token exchange for ID-JAG
jwtBearer.enabled: Enable the JWT bearer grant
backchannelLogout.enabled: Enable Back-Channel Logout
encryption.enabled: Enable encryption features
userinfo.enabled: Enable the UserInfo endpoint
jwtUserinfo.enabled: JWT UserInfo responses
revocation.enabled: Enable Token Revocation (RFC 7009)
globalTokenRevocation.enabled: Enable Global Token Revocation (Okta Universal Logout)
rpInitiatedLogout.enabled: Enable RP-Initiated Logout
claimsParameter.enabled: Enable the claims parameter
mTLS.enabled: Enable mTLS features (RFC 8705)
mTLS.certificateBoundAccessTokens: Certificate-bound access tokens
mTLS.selfSignedTlsClientAuth: self_signed_tls_client_auth method
mTLS.tlsClientAuth: tls_client_auth method
deviceFlow.enabled: Enable Device Authorization Grant (RFC 8628)
ciba.enabled: Enable CIBA flow
plans.enabled: Enforce plans
requestObjects.enabled: Enable Request Objects (JAR)
requestObjects.requireSignedRequestObject: Require signed request objects
resourceIndicators.enabled: Enable Resource Indicators (RFC 8707)
richAuthorizationRequests.enabled: Enable RAR (RFC 9396)
cors.enabled: Enable cross-origin access for browser clients
rateLimit.enabled: Refuse a calling origin that exceeds its request allowance
federation.enabled: Enable sign-in through an upstream identity provider
mcp.enabled: Enable the administrative MCP control plane
scim.enabled: Enable SCIM 2.0 provisioning
scim.secretCredentials: Allow client-secret credentials for SCIM
scim.staticTokens: Allow static tokens for SCIM
scim.strict: Strict SCIM: refuse non-conformant requests
errorStore.enabled: Record internal server faults
sentry.enabled: Report recorded faults to Sentry
registration.enabled: Enable Dynamic Client Registration
registration.issueRegistrationAccessToken: Issue registration access token
clientIdMetadataDocument.enabled: Accept a URL as a client identifier
registrationManagement.enabled: Enable registration management (RFC 7592)
registrationManagement.rotateRegistrationAccessToken: Rotate registration access token
conformIdTokenClaims: Conform ID Token claims
attackReports.enabled: Report attacking addresses to FoxTrust
Settings that are not reported
telemetry.enabled: a report exists only while it is on, so it would always read true.
mTLS.trustProxyCertificateHeader: describes the deployment's proxy in front of the server, not a feature anyone adopts.

PreviousEnvironment variablesNextAttack reporting