Cloudflare Worker proxy

The Worker proxy runs in your Cloudflare account, on your site's own host, at one path the dashboard issued. It forwards only the browser SDK's submissions, and cannot read events. Version 0.2.0.

Before you start

• A Cloudflare account with your site's zone.
• Node.js and pnpm, to deploy with Wrangler.

Deploy

1. 01

   Step 1: Create the proxy

   In the dashboard, open Integration > Proxy keys, create a proxy that runs as a Cloudflare Worker, for the same environment as your public key, and copy the proxy key it shows once. Note the path it issued, such as /k7x2qm4a.

2. 02

   Step 2: Configure the Worker

   Copy wrangler.toml.example to wrangler.toml. Set the route to exactly that path on your site's host, and FINGERLY_PATH to the same path.

   wrangler.toml

   name = "edge-k7x2qm4a"
   main = "src/index.ts"
   compatibility_date = "2026-09-01"
   routes = [{ pattern = "www.example.com/k7x2qm4a", zone_name = "example.com" }]
   
   [vars]
   FINGERLY_PATH = "/k7x2qm4a"
   

3. 03

   Step 3: Add the proxy key

   Terminal

   pnpm wrangler secret put FINGERLY_PROXY_KEY
   

   Paste the proxy key when prompted. It is stored as an encrypted Worker secret.

4. 04

   Step 4: Deploy

   Terminal

   pnpm install
   pnpm run deploy
   

5. 05

   Step 5: Point the browser SDK at it

   fingerly.ts

   const fingerly = await load({
     apiKey: 'fly_pk_production_…',
     endpoints: '/k7x2qm4a',
     fallbackToDefaultEndpoint: true,   // optional. Omit it to keep all traffic on your own site.
   })
   

   Once pages use it, the proxy's row in the dashboard shows it last seen, running cloudflare-worker/0.2.0, with its requests over the last 30 days.

Configuration

On a cross-host route, list the page origins in FINGERLY_ALLOWED_ORIGINS and use the full URL, https://edge.example.com/k7x2qm4a, in endpoints. A request from any origin other than the Worker's own host and the listed ones gets 403.

What the Worker does

• Answers only POST at its one path, plus CORS preflights for listed origins on a cross-host route.
• Forwards every request to https://api.fingerly.io/api/v1/ingest, the identification and the deferred report alike.
• Refuses bodies over 1 MiB with 413 and gives Fingerly 5 seconds before answering 502.
• Sends the visitor's address from CF-Connecting-IP, the page origin and the user agent, authenticated with the proxy key, and reports itself as cloudflare-worker/0.2.0.
• Relays back only content-type, x-request-id and the rate limit headers, so nothing in the response names Fingerly.
• Strips cookies and authorization headers, never follows redirects, and never logs bodies or credentials.