# Cloudflare Worker proxy

> Deploy a first-party proxy for the browser SDK in your own Cloudflare account. It forwards only identify requests, strips cookies and caps request bodies.

Last updated: 2026-09-17

The Worker proxy runs in your Cloudflare account on a path of your own site. It forwards only the browser SDK's identify and deferred-report requests, to the region your proxy key belongs to, and cannot read events.

## Before you start

- A Cloudflare account with your site's zone.
- A [proxy key](https://docs.fingerly.io/docs/proxy-integrations#proxy-keys), `fly_px_…`, for the same environment as your public key.
- Node.js and `pnpm`, to deploy with Wrangler.

## Deploy

### Step 1: Configure the Worker

Copy `wrangler.toml.example` to `wrangler.toml`. Choose a neutral Worker name and route. Avoid words such as `fingerprint`, `tracking` or `fingerly` in the public path, which content blockers look for.

```toml wrangler.toml
name = "edge-metrics"
main = "src/index.ts"
compatibility_date = "2026-09-01"
routes = [{ pattern = "shop.example.com/metrics/*", zone_name = "example.com" }]

[vars]
FINGERLY_ROUTE_PREFIX = "/metrics"
FINGERLY_ALLOWED_ORIGINS = "https://shop.example.com,https://example.com"
```

### Step 2: Add the proxy key

```bash Terminal
pnpm wrangler secret put FINGERLY_PROXY_KEY
```

Paste the proxy key when prompted. It is stored as an encrypted Worker secret.

### Step 3: Deploy

```bash Terminal
pnpm install
pnpm run deploy
```

### Step 4: Point the browser SDK at it

```ts fingerly.ts
const fingerly = await load({
  apiKey: 'fly_pk_us_production_…',
  endpoints: '/metrics',
  fallbackToDefaultEndpoint: true,   // optional
})
```

## Configuration

| Name | Kind | Meaning |
| --- | --- | --- |
| `FINGERLY_PROXY_KEY` | Secret | Your proxy key. Its prefix decides which regional API the Worker forwards to. |
| `FINGERLY_ROUTE_PREFIX` | Variable | The path before `/api/v1`. Must start with `/`. |
| `FINGERLY_ALLOWED_ORIGINS` | Variable | Comma-separated exact origins allowed to call the Worker. A request from any other origin gets `403`. |

## What the Worker does

- Answers CORS preflights for allowed origins, and only `POST` otherwise.
- Forwards only `{prefix}/api/v1/identify` and `{prefix}/api/v1/events/{request_id}/supplement`; anything else gets `404`.
- Refuses bodies over 1 MiB with `413` and gives Fingerly 5 seconds before answering `502`.
- Sends the visitor's address from `CF-Connecting-IP`, the allowed origin and the user agent, authenticated with the proxy key.
- Strips `Set-Cookie` from responses, never follows redirects, and never logs bodies or credentials.

> **Note:** Forwarding only ever goes to `us.api.fingerly.io` or `eu.api.fingerly.io`, chosen by the proxy key. Your data stays in its region. Where Cloudflare processes the request at the edge is governed by your own Cloudflare account settings.