New masking API, remote settings, and more

New Recorder Masking API

Session recording now supports unmasking inputs, as well as an allow-list based masking API for both inputs and text. New configuration options:

Option	Type	Default	Description
record_mask_all_text	boolean	true	When true, all text is masked by default. Use record_unmask_text_selector to selectively reveal specific elements.
record_mask_text_selector	string | string[]	undefined	CSS selector(s) for elements to mask. Only applies when record_mask_all_text is false.
record_unmask_text_selector	string | string[]	undefined	CSS selector(s) for elements to unmask. Only applies when record_mask_all_text is true.
record_mask_all_inputs	boolean	true	When true, all inputs are masked by default. Use record_unmask_input_selector to selectively reveal specific inputs.
record_mask_input_selector	string | string[]	""	CSS selector(s) for inputs to mask. Only applies when record_mask_all_inputs is false.
record_unmask_input_selector	string | string[]	""	CSS selector(s) for inputs to unmask. Only applies when record_mask_all_inputs is true.

Old record_mask_text_selector configuration options are migrated to the equivalent new config options for compatibility - e.g. record_mask_text_selector: '' will be applied as record_mask_all_text: false

Initial Remote Settings Support

Preparation to support remote settings functionality which will allow customizing session recording configurations (and eventually more) within the Mixpanel UI. The config option remote_settings_mode allows 3 states:

• strict - do not act (for instance, start session recording) unless the remote settings are loaded in a timely manner
• fallback - use fallback configuration values (options set during initialization) if remote settings fail to load in a timely manner
• disabled (default) - do not use or attempt to load remote settings

Remote settings are currently in a CLOSED alpha as of 1/27/2026, and the SDK API could be updated with breaking changes.

Other fixes

• Add missing typescript fields for api_routes (thanks @rnbrady!)
• Fix issue where Mixpanel import breaks in Safari when cookies are disabled: #530
• Deleted some outdated example directories

New hooks, extension support, type fixes

This release adds several new hooks for running code and intercepting SDK actions: before_identify, before_register, before_register_once, before_track, before_unregister. It also adds integration code for the Data Inspector browser extension and improves some of the library's type definitions.

Miscellaneous updates and bugfixes

Additions:

• Adds Autocapture rage-click configuration option interactive_elements_only, to ignore clicks on non-interactive page elements such as text. Configure with: mixpanel.init('<TOKEN>', {autocapture: {rage_click: {interactive_elements_only: true}}})
• Adds TypeScript types for Feature Flags subsystem (mixpanel.flags)
• Adds JS console data to Session Recordings, enabled by default but configurable via the record_console initialization option.

Fixes:

• Fixes an issue in session recording where closing and opening a page would upload a replay shorter than the configured minimum duration (record_min_ms)
• Fixes an issue in session recording where payloads get truncated on old Safari versions due to a bug in their CompressionStream implementation

Fix $mp_page_leave over-tracking

Fixes an issue where the $mp_page_leave is automatically captured when record_heatmap_data is on and there is no session recording taking place.

$mp_page_leave events will be excluded from Mixpanel billing for the month of October.

Autocapture Updates

New autocapture events are now available:

• Dead Click ($mp_dead_click): when a click occurs but there is no DOM mutation afterwards
• Page Leave ($mp_page_leave): when a page is "left" either by navigation or leaving the tab

Dead Click event tracking is ON in the default autotrack configuration, but Page Leave tracking must be turned on explicitly (with the config option {autocapture: {page_leave: true}}.

This release also includes several other updates:

• adding additional properties to experiment exposure events for feature flags
• upgrade rrweb fork to fix a hidden input masking issue
• getting rid of package.json exports feature to be less restrictive of what can be imported
• adding type definitions for each build option

rrweb upgrade and stricter disable_persistence

• Upgraded rrweb to use a Mixpanel-maintained fork containing performance fixes from the rrweb team (https://github.com/mixpanel/rrweb)
• Added additional handling for disable_persistence so that sessionStorage and IndexedDB are not modified
• Fixed TypeScript imports for custom builds

Rage-Click detection and other updates

This release adds support for Rage-Click tracking as part of the Autocapture subsystem. It is enabled in the default autocapture config, and can also be controlled explicitly with the rage_click autocapture init option.

Other updates include:

• Session Recording now blocks <audio> tags by default
• A new Feature-Flag method flags.update_context() facilitates updating context variables and refetching variants

Fixes and minor updates

• get_api_host() is now used consistently across the SDK to ensure that per-endpoint API host configs are respected everywhere
• A fix is included for the ordering of (asynchronous) operations when calling mixpanel.reset() while a session recording is active
• Default Feature Flag context now includes device_id alongside distinct_id
• $experiment_started events now include several API-latency-tracking properties

Fine-grained API host configuration and session recording fixes

A new api_hosts configuration option enables different endpoints (events, profiles, groups, session recordings) to be sent to different hosts, for selective proxying, e.g.:

mixpanel.init('<TOKEN>', {
  api_hosts: {
    // proxy only session-recording requests, and leave the rest on the default host api-js.mixpanel.com
    'record': 'https://my-proxy.com',
  },
});

This release also fixes a race condition when calling mixpanel.reset() while a session recording is active, and adds an initial TypeScript types.d.ts file.

Updates to revenue, session recording, autocapture, etc

This release packages up changes and improvements to several subsystems:

• The long-deprecated mixpanel.people.track_charge() method now only prints a console error and no longer sets a profile property or produces any other change. The old version of Mixpanel's Revenue analysis UI has been replaced by a newer suite of analysis tools which don't depend on profile properties (see https://docs.mixpanel.com/docs/features/revenue_analytics).
• Autocapture click tracking properties now include page height and width.
• Session recording now stops when mixpanel.reset() is called.
• New init optionapi_extra_query_params adds support for appending arbitrary query string params to tracking requests (useful for non-standard proxy setups)
• The API of the Feature Flagging system (under development) has been revised
• Whale Browser is now detected automatically