Serve analytics from your own domain.
Last reviewed 2026-10-26
Ad blockers and privacy tools block known third-party analytics hosts, which silently drops visits. Relaying the script and events through your domain recovers most of them.
Two options#
| Option | Where | How Virent trusts the visitor's network |
|---|---|---|
| Relay (recommended) | Next.js proxy.ts, nginx, a Cloudflare Worker or any reverse proxy | Forwarded headers, authenticated with the website's server secret |
| SDK route | A Next.js route handler with createVirentAnalyticsProxy (/vt/*) | The same headers and secret, set by the SDK |
Each framework guide has a "First-party (recommended)" section with copy-paste code, and the dashboard's Connect analytics dialog has the same snippets under Install manually → First-party (recommended).
Relay contract#
- Relay only two paths under
/_vron your domain:/_vr/js/script.jstohttps://app.virent.app/js/script.js, and/_vr/v1/*tohttps://app.virent.app/v1/*. - Forward only the
accept-language,content-type,originanduser-agentrequest headers. - Add
x-virent-forwarded-forwith the visitor's IP as your relay sees it, andx-virent-forwarded-countrywith the ISO country code when your host provides it. - Add
x-virent-proxy-keywith your website's server secret (vha_sk_…). Virent ignores the forwarded headers without it, and refuses a secret that belongs to another website. Keep the secret in your relay's configuration or environment, never in browser code. - Never forward cookies or authorization headers.
Then load the script from your domain:
<script defer src="/_vr/js/script.js" data-api="/_vr" data-write-key="vha_pk_..."></script>With the browser SDK, pass endpoint: "/_vr/v1/ingest/batch", identifyEndpoint: "/_vr/v1/identify" and goalEndpoint: "/_vr/v1/track/goal" to initVirent. SDK 0.3.1 does not derive the identify and goal URLs from a relative endpoint.
Why plain rewrites are not enough#
Without the forwarded headers and the secret, every visit would arrive with your relay's IP and location: all visitors would look like one person in one country, and they would share one visitor's rate limit. A rewrites() entry in next.config.js or vercel.json can't add request headers, so on Next.js the relay is a rewrite in proxy.ts.
Verify#
Open your site
With the browser's network panel open.
Check the requests:
/_vr/js/script.jsloads from your domain, and pageviews post to/_vr/v1/ingest/batch.Check the dashboard
Visits arrive with the right countries, not your server's.
Virent CLI
Install the Virent command line (@virent.app/cli) to read analytics with an API key and validate a publishable key against your site from a terminal or an AI agent.
Runtimes and coverage
What each Virent installation observes on browser-only sites, Next.js, Node.js servers and edge runtimes, and the collection controls that apply.