Cloudflare Worker proxy

The Worker proxy runs in your Cloudflare account on a path of your own site. It forwards only the browser SDK's identify and deferred-report requests, to the region your proxy key belongs to, and cannot read events.

Before you start

• A Cloudflare account with your site's zone.
• A proxy key, fly_px_…, for the same environment as your public key.
• Node.js and pnpm, to deploy with Wrangler.

Deploy

1. 01

   Step 1: Configure the Worker

   Copy wrangler.toml.example to wrangler.toml. Choose a neutral Worker name and route. Avoid words such as fingerprint, tracking or fingerly in the public path, which content blockers look for.

   wrangler.toml

   name = "edge-metrics"
   main = "src/index.ts"
   compatibility_date = "2026-09-01"
   routes = [{ pattern = "shop.example.com/metrics/*", zone_name = "example.com" }]
   
   [vars]
   FINGERLY_ROUTE_PREFIX = "/metrics"
   FINGERLY_ALLOWED_ORIGINS = "https://shop.example.com,https://example.com"
   

2. 02

   Step 2: Add the proxy key

   Terminal

   pnpm wrangler secret put FINGERLY_PROXY_KEY
   

   Paste the proxy key when prompted. It is stored as an encrypted Worker secret.

3. 03

   Step 3: Deploy

   Terminal

   pnpm install
   pnpm run deploy
   

4. 04

   Step 4: Point the browser SDK at it

   fingerly.ts

   const fingerly = await load({
     apiKey: 'fly_pk_us_production_…',
     endpoints: '/metrics',
     fallbackToDefaultEndpoint: true,   // optional
   })
   

Configuration

What the Worker does

• Answers CORS preflights for allowed origins, and only POST otherwise.
• Forwards only {prefix}/api/v1/identify and {prefix}/api/v1/events/{request_id}/supplement; anything else gets 404.
• Refuses bodies over 1 MiB with 413 and gives Fingerly 5 seconds before answering 502.
• Sends the visitor's address from CF-Connecting-IP, the allowed origin and the user agent, authenticated with the proxy key.
• Strips Set-Cookie from responses, never follows redirects, and never logs bodies or credentials.