Skip to main content
The best configuration follows the product interaction the customer agent already performs. Do not invent an agent identity or an Epode-only session.

​
Search APIs with shared caching

If ordinary traffic shares a CDN response, use cacheMode: "request". A feedback-aware caller sends Agent-Feedback-Request: 1; public callers keep the public cache policy. The SDK adds Vary: Agent-Feedback-Request to both variants. If a CDN strips Vary, configure the same cache-key rule at the edge or do not use request mode. Eligible ordinary 2xx GET and HEAD responses include a relative same-URL Link marker so Epode Companion can discover request mode and make one opt-in refetch. The refetch preserves the original authentication context, adds only Agent-Feedback-Request: 1, and stops on redirects; the public body is unchanged. Run the search example

​
Static sites, CMSs, and hosted documentation

When your team controls the public edge route, use the static docs trusted-edge proxy. It preserves the upstream body and ordinary public cache policy, keeps the product key in an edge secret, and sends feedback reports directly to Epode. Bind it only to dedicated public docs routes, never a hostname-wide catch-all; include provides a second fail-closed path boundary. If you cannot control the public response route, keep the site uninstrumented; client JavaScript is not a safe fallback.

​
Async APIs

Use shouldInstrument to expose feedback only when the body reaches a terminal status. This avoids asking the agent to evaluate a job it has not used yet. Run the crawl example

​
Stateful MCP without micro-feedback

Use includeTools for the complete trace and feedbackTools for the final boundary. A sessionRef extractor may group calls only after trusted server/product state has established the journey. Never use a tool argument, model-proposed ID, or transport connection as proof. Run the browser example

​
Authenticated, sensitive operations

Derive accountRef and userRef from verified API or OAuth context and anonymousRef from a product-owned first-party visitor ID. Keep customerRef only for durable Ask once and identical to accountRef; never pair it with userRef alone. Never use an email address, caller value, prompt, or tool argument. Epode rejects feedback containing likely personal data, secrets, prompts, transcripts, or raw product content. The agent may retry the same handle with a safe abstract summary. Run the authenticated operations example

​
Multi-tenant products

Extract accountRef from verified server-side auth after the tenant has been selected. Use a stable opaque ID such as acct_42, not an email, display name, bearer token, or request body value. If durable Ask once is enabled, use that exact same ID for customerRef. If a request can operate on behalf of another tenant, use the authorization result—not the caller-supplied target—as the source.

​
Streaming, binary, and large responses

Epode deliberately leaves SSE, chunked streams, file downloads, images, archives, and other binary bodies untouched. Instrument a finite JSON completion or manifest endpoint only when it represents an outcome the agent has actually experienced. If no such endpoint exists, that surface has no safe HTTP outcome boundary; use native MCP or keep it uninstrumented.

​
Serverless lifecycle

Create the SDK runtime outside the handler so warm invocations share its bounded queue. On Node platforms with a post-response lifecycle, pass feedback.flush() to waitUntil. Do not turn telemetry into a blocking dependency. A platform that freezes immediately after returning may drop opportunity telemetry; the product response and signed feedback submission remain independent.