Skip to content
FoxAuth

Usage reporting

Once a day, a FoxAuth server sends one small report to the FoxAuth maintainers. The report says which version the server runs, on what, with which features on, and roughly how big it is. The maintainers use it to decide what to keep, what to fix first and what nobody uses any more.

Reporting is on by default. Nothing in a report names you, your projects, your applications or your users. A report that cannot be delivered is not an error: the server carries on and tries again the next day.

Turning it off

In the console: Settings → Integrations → Usage reporting. The change applies at once, without a restart. This setting is the only switch.

The console card under the switch shows the exact report the server last sent, so you can check what left it.

The addresses that attack a server are reported separately, hourly, under a switch of their own: see Attack reporting.

Where it goes

Reports go to https://api.foxtrust.dev/v1/foxauth/usage, run by the FoxAuth maintainers. The receiver does not store the address a report comes from, and keeps reports for 13 months.

Every field

This is format 1. Counts are never exact: each is sent as one of these ranges: 0, 1, 2-10, 11-100, 101-1000, 1001-10000, 10001-100000, 100001+.

FieldWhat it saysValues
formatThe version of this report format.1
instanceIdA random identifier this server generated for itself and keeps in its database. It is derived from nothing, so it says nothing about who runs the server; it only lets reports from one server be grouped.a UUID
foxauth.versionThe FoxAuth release this server runs. Left out when the package manifest cannot be read.a version such as 1.3.0
runtime.bunThe Bun version this server runs on.a version such as 1.3.4
runtime.osThe operating system.a Node.js platform name such as linux, darwin or win32
runtime.archThe processor architecture.a Node.js architecture name such as x64 or arm64
runtime.containerWhether the server appears to run in a container. A best guess from the usual container markers.true or false
storageWhich database the server stores its data in.mongodb or postgres
features.<setting>Whether a feature setting is on. Only the on/off of the settings listed as reported is sent, never a value.true or false
size.projectsHow many projects the server holds, the administrators' own project included.one of 0, 1, 2-10, 11-100, 101-1000, 1001-10000, 10001-100000, 100001+
size.applicationsHow many applications are registered across all projects.one of 0, 1, 2-10, 11-100, 101-1000, 1001-10000, 10001-100000, 100001+
size.apisHow many APIs (protected resources) are declared.one of 0, 1, 2-10, 11-100, 101-1000, 1001-10000, 10001-100000, 100001+
size.administratorsHow many administrator accounts exist.one of 0, 1, 2-10, 11-100, 101-1000, 1001-10000, 10001-100000, 100001+
size.monthlyActiveUsersPeople who received tokens this calendar month, summed over projects.one of 0, 1, 2-10, 11-100, 101-1000, 1001-10000, 10001-100000, 100001+
day.dateThe UTC day the day figures below describe: the day before the report. Left out when the server has no figures for that day yet, for example on its first day.a date, YYYY-MM-DD
day.tokens.<grant>How many token responses that grant type produced that day. A grant type with none is left out. Left out when the server has no figures for that day yet.one of 0, 1, 2-10, 11-100, 101-1000, 1001-10000, 10001-100000, 100001+; grant names are authorization_code, client_credentials, refresh_token, device_code, ciba, jwt_bearer, token_exchange
day.serverErrorsDefects the server recorded that day: 5xx responses and faults in background work, counted whether or not its error store is on. Left out when the server has no figures for that day yet.one of 0, 1, 2-10, 11-100, 101-1000, 1001-10000, 10001-100000, 100001+

Never sent

No name, email, hostname, issuer URL or network address. No identifier of a project, an application or a person. No value of any setting: only whether the features below are on or off.

Settings whose on/off is reported

Settings that are not reported

  • telemetry.enabled: a report exists only while it is on, so it would always read true.
  • mTLS.trustProxyCertificateHeader: describes the deployment's proxy in front of the server, not a feature anyone adopts.