StepprOne snippet. Around 23 kilobytes on the wire.
Drop a single script tag into your <head>. The SDK renders inside its own Shadow DOM root, patches history.pushState to detect SPA routes, and uses MutationObserver to wait for elements that mount async.
// after the snippet loadswindow.Steppr.identify('user_42', { plan: 'pro', company: 'Acme'}); // fire an event-based triggerSteppr.track('invite_sent');- ~23 KB gzipped, defer-loaded, never blocks paint - everything ships in one bundle (tours, checklists, announcements, Resource Center)
- Shadow DOM isolation prevents CSS bleed in either direction
- Auto SPA route detection (history pushState/popstate)
- identify() and track() hooks for trait and event-based personalisation
- No npm install, no React component, no framework lock-in - vanilla JS works in any stack
SDK, in detail.
Two lines. That is the install.
Paste the snippet into your <head>. It loads steppr.js deferred from our CDN with your public key, fetches the published snapshot for your workspace, and starts evaluating targeting rules. There is no build step, no package to bump and no framework adapter to maintain.
Two calls. That is the API.
steppr.identify(userId, traits) tells Steppr who the user is and what traits to target on. steppr.track(name) fires a named event that can trigger a flow, complete a checklist item or gate a tour step. Both are optional; anonymous visitors work out of the box with a per-browser id.
Built to survive real front-ends.
Route changes are detected by patching history.pushState and replaceState and listening for popstate. Targets that mount late are found by a MutationObserver with retries. All UI lives in a Shadow DOM root so neither side’s CSS can leak. Shadow DOM and cross-origin iframes on your site are not targetable in v1 and fail gracefully rather than breaking the page.
Locked to your domains.
The public key is not a secret. Every SDK request carries its Origin and the API rejects anything not on your workspace’s allowed-origins list, wildcard subdomains included. Ten origins per workspace on every plan.
SDK FAQ.
Straight answers. If yours isn't here, email hello@steppr.io and a founder replies.
Yes. The SDK is vanilla JavaScript loaded by a script tag, so it works in any stack. SPA route changes are detected automatically.
About 23 KB gzipped, with a build-time guard that fails the release if it grows past budget. It loads deferred and never blocks paint.
No. Requests are checked against your allowed origins, so the key only works from domains you have listed.
Not in v1. Those targets are documented as unsupported; a step pointed at one is skipped gracefully.
Try sdk free for 7 days.
No card to start. The trial unlocks Growth-tier features so you can evaluate the whole product, not a stripped-down preview.