Your SDK ships to thousands of apps. See what happens next.
Once your SDK is in someone else’s app, you lose sight of it. SDK Garden shows which
versions are still running in the wild, where integrations stall before the first successful
call, and which parts of your API nobody uses, so you know what to fix, what to deprecate, and
who to nudge to upgrade.
Free for your first SDK. About fifteen minutes to set up. The demo needs no signup.
acme-nodeacme-pythonacme-go
Init rate
96.4%
Sessions · 7d
48,210
p50 init
41ms
3.2.054%0.8% err
3.1.427%1.1% err
2.9.115%12.6% err
2.4.04%2.0% err
2.9.1 is still on 15% of installs and fails twelve times as often. Worth a deprecation notice.
// the blind spot
Your tools watch your app. Nothing watches your SDK.
Download counts stop at the install. Everything after that happens inside apps you
don’t own, run by developers you’ll never hear from unless something breaks badly
enough to open an issue.
Error tracking
Sentry tells you when your app crashes.
Great for code you deploy. Blind to your library running in thousands of apps you’ll never see.
Product analytics
Product analytics tells you what your users click.
Built for end users and screens, not for developers calling methods on your API.
SDK Garden
SDK Garden tells you what happens to your SDK once it ships.
Versions in the wild, integrations that stall, and the API surface people actually depend on, across every language you publish.
// what you'll know
Know what to fix, what to deprecate, and who to nudge
Your issue tracker only hears from the developers who got stuck and bothered to write in.
SDK Garden hears from every install.
Which versions are still out there?
See the share of real sessions on each release, not just download numbers. Find out that
40% of installs are still on v1.x before you ship a breaking change, and know when
it’s finally safe to drop an old major. SDK Garden flags versions nobody has run for 30 days.
3.x · 81%2.9
3.x2.9.xolder
share of sessions, last 30 days
Where do integrations stall?
Follow every session from process start to the first successful call, and see exactly where
integrations stall before they get there. A drop between "started" and "initialized" usually
means a missing key, a bad config, or a runtime you don’t support yet.
started100%
initialized83%
called a method61%
used a feature34%
17% of sessions never finish initializing — see which versions and runtimes
Which methods does anyone actually call?
Wrap your public methods and get call counts, error rates and durations for each. Find the
API surface people depend on before you change it, and the parts nobody uses that you can
safely deprecate.
method
calls
errors
p50
charges.create
1.2M
0.4%
88ms
customers.get
640K
0.1%
31ms
refunds.create
52K
2.3%
120ms
legacy.sync
14
—
—
legacy.sync: 14 calls in 90 days
Did the last release make things worse?
Error rates per version, compared with your average, the day a release starts rolling out.
Catch the regression while it's on 3% of installs, not 60%.
3.2.00.8%
3.1.41.1%
3.3.0-rc4.7%
3.3.0-rc errors at 4× the account average
// integration
About fifteen lines, once
You add the client to your SDK. Your users don't install or configure anything.
Create an SDK and a keyOne per client library you publish.
Initialize the client when your SDK loadsEvents are batched and sent in the background.
Wrap the public methods you care aboutCalls, durations and errors are recorded for each.
Network failures are swallowed — the client never throws into your users' code. Set disabled: true to turn it off, for example when your own users opt out.
Node, Python, Go, Java and Swift clients would be five SDKs. Each gets its own dashboard, keys and event allowance.
// your users' data
What the client sends, exactly
You’re putting this inside other people’s apps, so here is the whole list.
Sent with events
Your SDK's name and version
Event type, method name and duration
Error type and message, with email addresses redacted
A random session ID created each time your SDK initializes
Runtime and language version, and how long your SDK took to initialize; in browsers also screen and viewport size, locale, timezone and the site’s origin (never the page path, query string or referrer)
Never sent
Argument values or return values of your methods (Python sends only the number of arguments)
Cookies, or IDs that follow a person across sessions
Anything at all when you pass disabled: true
// security
Where the data goes and who handles it
Your customers' security teams will ask. These are the answers.
How we protect it
Every request is served over HTTPS. Plain HTTP is redirected
Each account's events, keys and dashboards are kept separate, and every query is scoped to the signed-in account
API keys are stored only as SHA-256 hashes. We can't read them back, so a new key is shown once
Passwords are hashed with Argon2id
SSO client secrets are encrypted with AES-256-GCM before they're stored
Where it lives
The app and its database run in the United States, in the US East region (Ashburn, Virginia)
Events go to one hostname, so your customers' network teams have a single destination to allowlist
Telemetry can be switched off in code with disabled: true
Subprocessors
These are the companies that process data on our behalf to run SDK Garden. We’ll update this list before we add a new one.
Company
What it does for us
Data it handles
Location
Fly.io
Application hosting and the managed PostgreSQL database
Account details and SDK events
United States
Upstash
Redis for rate limiting
Short-lived request counters, keyed by hashed API key or, for sign-in, by IP address
United States
Netlify
Hosting for this marketing site
Standard web request logs. No SDK events
Global CDN
To report a vulnerability or request our security details, email hello@sdkgarden.com.
// questions
Things people ask first
Will it slow down my SDK?
Events go into an in-memory buffer and are sent in batches in the background — on a daemon thread in Python, with fetch in JavaScript. Your methods don't wait on the network.
What happens if SDK Garden is down?
Nothing your users would notice. Network errors are caught inside the client and never reach their code.
How is this different from Sentry or product analytics?
Sentry tells you when your app crashes. Product analytics tells you what your users click. Neither tells you what happens to your SDK once it ships into everyone else’s apps. SDK Garden shows which versions are still running in the wild, where integrations stall before the first successful call, and which parts of your API nobody uses. It works alongside Sentry, not instead of it.
Which languages are supported?
JavaScript/TypeScript (Node and browsers) and Python today. The ingest API is a documented JSON endpoint, so other languages can send events directly while their clients are in progress.
Can we use our identity provider?
Yes. Single sign-on over OpenID Connect works with Okta, Microsoft Entra ID, Google Workspace, Auth0 and others, on every paid plan.
See what happens to your SDK after it ships.
Free for your first SDK. Setup takes about fifteen minutes, and the dashboard tells you the moment the first event arrives.