---
title: "WebView"
description: "Learn how to connect traces and monitor errors and performance across the Sentry Android and Browser SDKs with WebView."
url: https://docs.sentry.io/platforms/android/configuration/webview/
---

# WebView for Android

To monitor errors and performance in web views of Android applications, you set up Sentry SDKs in both the mobile application and the web projects running in the web views. You can also connect their traces, so a single distributed trace spans your app and the web content it embeds.

## [Application Monitoring](https://docs.sentry.io/platforms/android/configuration/webview.md#application-monitoring)

To monitor errors and performance in the native part of the application, follow the [Sentry Android SDK setup instructions](https://docs.sentry.io/platforms/android.md). The Android SDK doesn't capture errors that happen inside a web view — those are captured by the JavaScript SDK running in the web project (see [WebView Monitoring](https://docs.sentry.io/platforms/android/configuration/webview.md#webview-monitoring)).

## [WebView Monitoring](https://docs.sentry.io/platforms/android/configuration/webview.md#webview-monitoring)

To monitor errors and performance in web views, choose the appropriate Sentry JavaScript SDK depending on the framework used in the web project.

* [Sentry React SDK](https://docs.sentry.io/platforms/javascript/guides/react.md) (if the web project uses React)
* [Sentry Angular SDK](https://docs.sentry.io/platforms/javascript/guides/angular.md) (if the web project uses Angular)
* [Other Sentry JavaScript SDKs](https://docs.sentry.io/platforms/javascript.md)

## [Connect Traces](https://docs.sentry.io/platforms/android/configuration/webview.md#connect-traces)

`SentryWebViewTracing` is available from Android SDK version `8.64.0`.

Use `SentryWebViewTracing.addTracePropagation` to inject your app's trace into an `android.webkit.WebView`. The Browser SDK running in the web page picks it up on pageload and continues the same trace, so the web page's pageload transaction and errors share the trace of your app. The result is a single connected trace across the native and web parts of the user journey.

Trace propagation uses the [AndroidX WebKit](https://developer.android.com/jetpack/androidx/releases/webkit) library, which the Android SDK doesn't add for you. Add it to your app:

```kotlin
dependencies {
    implementation("androidx.webkit:webkit:1.14.0")
}
```

Then call `addTracePropagation` before the web view loads the page:

```kotlin
import io.sentry.android.core.SentryWebViewTracing

SentryWebViewTracing.addTracePropagation(webView, "example.com")
webView.loadUrl("https://example.com")
```

*Other available variations of the above snippet: Java*

You can pass several hosts, or a `List<String>`. Trace propagation applies to pages that start loading after the call. Call it from the main thread. The method returns `false` if nothing was added, for example when the `androidx.webkit` dependency is missing, the device's System WebView doesn't support it, no host is valid, the SDK isn't initialized, or it's called from another thread.

For the connection to take effect:

* The web page must run a Sentry [Browser SDK](https://docs.sentry.io/platforms/javascript.md) with tracing enabled (the `browserTracingIntegration`). It continues the trace from the injected `sentry-trace` and `baggage` `<meta>` tags automatically, the same way it continues a trace started by a server (see [Distributed Tracing](https://docs.sentry.io/platforms/javascript/tracing/distributed-tracing.md)) — no additional configuration is needed on the web page. The SDK writes the tags with a document-start script, before any page script runs, so the Browser SDK can be initialized anywhere in the page.
* The hosts you pass declare the hosts you trust to load in this web view. A page is matched when it's served over HTTPS and its hostname equals an entry or is a subdomain of it (for example, `"example.com"` matches both `example.com` and `app.example.com`). Matching is case-insensitive. Entries are normalized, so a scheme, path, trailing dot, or leading `*.` is ignored, and internationalized hostnames are converted to their ASCII form. A port other than `443` limits the entry to pages served on that port (for example, `"example.com:8443"`). The trace context is only written on matching pages, and only in the main frame, not in iframes.

Only list hosts whose content you trust. The trace context is injected into every matching page, so an allow-listed page that runs untrusted JavaScript can read it back and feed misleading or polluted data into the connected trace. This risk is bounded by the hosts you list — don't allow-list pages that render untrusted or third-party content.

The hosts are enforced by the web view and also checked inside the web page as defense-in-depth for honest cross-host navigation, but they're **not a strict security boundary**, since a hostile page sharing the web view could bypass an in-page check.

The injected trace context carries no secrets or PII by default: the root span name (`sentry-transaction`), which can contain parameterized URLs, is stripped from `baggage` before it is injected. Still, don't put sensitive data in `baggage` for web views that may load untrusted pages.

The injected trace is a snapshot taken when you call `addTracePropagation`, and every later page load in that web view reuses it. To connect a later page load to a newer trace, call `addTracePropagation` again before the navigation. It replaces the script Sentry added earlier and keeps your own scripts.

### [Pages Bundled With Your App](https://docs.sentry.io/platforms/android/configuration/webview.md#pages-bundled-with-your-app)

Pages loaded with `loadData`, with `loadDataWithBaseURL` and a base URL that isn't HTTPS, or from `file://` URLs don't receive the trace. To show pages bundled with your app, serve them over HTTPS with [`WebViewAssetLoader`](https://developer.android.com/reference/androidx/webkit/WebViewAssetLoader) and allow its domain:

```kotlin
import android.webkit.WebResourceRequest
import android.webkit.WebResourceResponse
import android.webkit.WebView
import android.webkit.WebViewClient
import androidx.webkit.WebViewAssetLoader
import io.sentry.android.core.SentryWebViewTracing

val assetLoader =
    WebViewAssetLoader.Builder()
        .addPathHandler("/assets/", WebViewAssetLoader.AssetsPathHandler(context))
        .build()
webView.webViewClient =
    object : WebViewClient() {
        override fun shouldInterceptRequest(
            view: WebView,
            request: WebResourceRequest,
        ): WebResourceResponse? = assetLoader.shouldInterceptRequest(request.url)
    }

SentryWebViewTracing.addTracePropagation(webView, WebViewAssetLoader.DEFAULT_DOMAIN)
webView.loadUrl("https://${WebViewAssetLoader.DEFAULT_DOMAIN}/assets/index.html")
```

*Other available variations of the above snippet: Java*

### [Limitations](https://docs.sentry.io/platforms/android/configuration/webview.md#limitations)

* Trace propagation requires an Android System WebView that supports document-start scripts (`WebViewFeature.DOCUMENT_START_SCRIPT`). On older WebViews, `addTracePropagation` returns `false` and the web page starts its own trace.
* Only `android.webkit.WebView` is supported, including a `WebView` shown with `AndroidView` in Jetpack Compose. Custom Tabs and Trusted Web Activities run in the browser app, so scripts can't be injected into them.
* Only HTTPS pages receive the trace.
* When no span is active, the injected trace doesn't carry a sampling decision, so the Browser SDK makes its own sampling decision for the web page.

The trace is connected on the web page's initial load. Client-side navigations within a single-page app in the web view start their own traces, as they do in a regular browser.

The app and the web project can report to different Sentry projects — as long as they're in the same organization, the trace view stitches the transactions together by trace ID.

## [Notes](https://docs.sentry.io/platforms/android/configuration/webview.md#notes)

* The JavaScript SDK should be initialized when the web view is created and will be closed when the web view is closed. To monitor all web views in the application, initialize the JavaScript SDK every time a web view is created.

* If the web project is accessed remotely and not unique to the mobile application (for example the project also works as a standalone web application), we recommend using separate Sentry projects for the mobile application and the web project.