> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corbado.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Compatibility and Constraints
> What Corbado Observe requires, which platforms and browsers it supports, what data it collects and the known limitations of Autocapture.
This page answers the question every engineering team asks first: **will this work with our stack, and what does it do to our application?**
## 1. What Observe requires
| Requirement | Detail |
| ------------------------------ | ------------------------------------------------ |
| A web frontend or a native app | See the platform table below. |
| A Corbado project | Provides your `Project ID` and `API Base URL`. |
| Outbound network access | The SDK sends batched events to the Corbado API. |
There is **no backend integration**, no server-side SDK, no IdP configuration and no change to your authentication logic. Observe works the same whether you run a commercial IdP, an open-source WebAuthn library or a custom in-house implementation. See [what Observe is not](/corbado-observe/overview/how-it-works#3-what-observe-is-not).
Observe is telemetry only. It is not in the authentication path and cannot grant, deny, delay or alter a login. An SDK failure, a blocked request or a missing configuration costs you telemetry, never an authentication.
## 2. Platform support
| Platform | Autocapture | Custom events | Notes |
| ----------------------------------------------------------- | ----------- | ------------- | ---------------------------------------------------------------------------------------------------------- |
| Web apps (SSR, SPA, MPA) | Yes | Yes | Same-document route changes are observed, so a journey survives a client-side router. |
| Web frameworks (React, Vue, Svelte, Angular, Next.js, Nuxt) | Yes | Yes | No framework-specific integration required. |
| Web views inside native apps | Yes | Yes | The SDK runs in the web view. |
| Cross-origin iframes | Yes | Yes | The SDK must run in the frame that performs the ceremony. See [Iframes and RP IDs](#3-iframes-and-rp-ids). |
| iOS (Swift) | No | Yes | Native SDK. Autocapture is a browser technique and has no native equivalent. |
| Android (Kotlin) | No | Yes | Native SDK, `com.corbado:observe`, minSdk 23. |
**JavaScript-based mobile frameworks** such as React Native with Expo, Ionic or Capacitor authenticate through a web surface and are covered by the web integration wherever the login runs in a web context. Where a framework routes passkeys through a native platform API instead, use the native SDK for that platform.
Native SDKs send into the same [data model](/corbado-observe/tracking/overview) as the web SDK, so web and app journeys are comparable in the same project. Keep them apart with [applications](/corbado-observe/tracking/applications). App authentication behaves differently enough from web that the metrics worth tracking differ too: see [Native app authentication analytics](https://www.corbado.com/blog/native-app-authentication-analytics).
## 3. Iframes and RP IDs
If your authentication runs inside an iframe, which is common for embedded login and embedded wallets, two things matter:
* **The SDK must run in the frame that performs the ceremony.** `navigator.credentials` calls are observed in the document that makes them, not in the parent.
* **The iframe must be permitted to perform WebAuthn.** A cross-origin iframe needs the `publickey-credentials-get` and `publickey-credentials-create` permissions policy for passkeys to work at all. That is a requirement of your own implementation, not of Observe, but it is the first thing to check when ceremonies appear to be missing.
See the guide on [relying party IDs](/corbado-connect/helpful-guides/rpid-configuration/overview) for background on RP ID scoping.
## 4. Data handling
Observe does not need PII to do its job. It collects no names, email addresses, phone numbers or other directly identifying attributes; the only identity-linked value is the user reference you choose to pass, and that can be pseudonymous.
**Never collected:** passwords or any other typed input, form field contents, session tokens or credentials for your own system.
**Collected:**
| Data | Purpose |
| ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------ |
| Authentication journey events | Flows, steps, decisions and errors: the funnel itself |
| Device and client capability signals | Browser, operating system, device model where available, WebAuthn capability flags such as platform-authenticator availability |
| WebAuthn ceremony data | Ceremony lifecycle, mediation, authenticator and credential metadata (AAGUID, transports, backup state, discoverability) |
| A user reference, if you provide one | Links journeys to your own user entity. See [Users](/corbado-observe/tracking/user) |
| Tags you define | Your own dimensions such as country, channel or experiment variant. See [Tags](/corbado-observe/tracking/tags) |
WebAuthn responses are inherently identifying: they contain credential IDs, user handles, challenges, signatures and authenticator data. Observe collects the fields it needs for authenticator and credential insight. If you must not send user handles or credential IDs to a processor, raise this before integration so the collection profile can be scoped accordingly.
**You control identity.** The user reference is a value you pass. Pass a pseudonymous or hashed identifier and Observe never sees a real user ID.
## 5. Autocapture limitations
Autocapture observes the browser surfaces listed under [what Autocapture actually does](/corbado-observe/overview/integration-paths#1-1-what-autocapture-actually-does). Where it stops:
| Limitation | Effect |
| ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Password managers that lock WebAuthn accessors** | Some extensions replace `navigator.credentials` with non-writable accessors. 1Password is a tested example. Autocapture then reports WebAuthn capture as unavailable and rolls back cleanly: **passkey operations keep working**, but those ceremonies produce no WebAuthn telemetry. |
| **Another integration overwriting the same surface** | If a third-party script replaces a patched method without forwarding through it, capture is displaced for that surface. The application call still succeeds, the telemetry is lost. |
| **Facts that never reach the browser** | Anything that exists only in your native app or your backend cannot be observed. Add it with [custom events](/corbado-observe/overview/integration-paths#3-where-autocapture-stops). |
## 6. Browser and OS support
| SDK | Floor |
| ------- | --------------------------------------------------------------------------------------------------------------------------------------- |
| Web | Targets ES2019. Tested on current Chromium, Firefox and WebKit, including password-manager simulation and virtual WebAuthn in Chromium. |
| Android | minSdk 23. |
| iOS | [Contact us](mailto:support@corbado.com) for the current minimum deployment target. |
If you need a documented floor for older Android WebViews, legacy Edge or specific enterprise browser versions, [ask us](mailto:support@corbado.com). The tested matrix is expanding and we would rather give you a precise answer than a marketing one.
## 7. Storage and consent
The web SDK stores a session identifier client-side to correlate the events of one journey. You choose the mechanism at initialization:
| Option | Behavior |
| ------------------- | ---------------------------------------------------------------------------- |
| `storage: "local"` | Browser storage on the current origin. |
| `storage: "cookie"` | A cookie, with an optional `cookieDomain` for correlation across subdomains. |
Observe stores no advertising identifiers and does no cross-site tracking. Whether your consent management platform needs to gate the SDK is your own legal assessment. If it does, initialize Observe after consent and journeys before that point are simply not recorded.
## 8. Projects, environments and hosting
Keep **environments in separate projects**. Production, staging and development should not share a project, because mixed data makes funnels meaningless. Use [applications](/corbado-observe/tracking/applications) to separate channels of the same product and [tags](/corbado-observe/tracking/tags) for further dimensions.
Observe runs on Corbado's public cloud by default. Dedicated instances in a specific region are available for enterprise deployments, which matters if you have data residency requirements. [Contact us](mailto:support@corbado.com) to discuss options.
## 9. Next steps
Autocapture vs. custom events.
Confirm events are arriving before you ship.