First-party Proxy (Ad-blocker Bypass)

By default the Logspot script loads from cdn.logspot.io and sends events to api.logspot.io. Some content blockers and privacy browsers block requests to known analytics hostnames, which silently drops a slice of your data. Routing both through your own domain, a first-party proxy, can help recover some of that data in those cases.

This is optional. Logspot is first-party and consent-aware by design so the proxy primarily helps with hostname-based blocking that may happen even when the user has consented to analytics or marketing.

How It Works

Two requests need to go through your domain:

1. The script — https://cdn.logspot.io/lg.js → e.g. https://yourdomain.com/lg.js
2. The API — https://api.logspot.io → e.g. https://yourdomain.com/_lg

You proxy both with your existing web server or CDN, then tell the SDK where the API now lives:

• Script tag: set data-api-url to your proxied API path.
• @logspot/web SDK: set externalApiUrl to your proxied API path.

The SDK derives the /identify and /consent endpoints from the events URL, so point externalApiUrl / data-api-url at the events path (the equivalent of api.logspot.io/i) and the sibling routes resolve automatically.

<!-- script served from your own domain, API proxied to /_lg/i -->
<script
  src="https://yourdomain.com/lg.js"
  data-logspot-pk="YOUR_PUBLIC_KEY"
  data-api-url="https://yourdomain.com/_lg/i"
></script>

// or with the SDK
import Logspot from '@logspot/web';

Logspot.init({
  publicKey: 'YOUR_PUBLIC_KEY',
  externalApiUrl: 'https://yourdomain.com/_lg/i',
});

Keep x-logspot-pk flowing. The SDK sends your public key in the x-logspot-pk header; make sure your proxy forwards request headers (most do by default).

Next.js (Rewrites)

Add rewrites in next.config.js so Next proxies both paths server-side:

// next.config.js
module.exports = {
  async rewrites() {
    return [
      { source: '/lg.js', destination: 'https://cdn.logspot.io/lg.js' },
      { source: '/_lg/:path*', destination: 'https://api.logspot.io/:path*' },
    ];
  },
};

Then load the script from your domain with data-api-url="/_lg/i" (a relative URL works because requests are same-origin).

Nginx

# Proxy the script
location = /lg.js {
  proxy_pass https://cdn.logspot.io/lg.js;
  proxy_set_header Host cdn.logspot.io;
}

# Proxy the API (events, identify, consent)
location /_lg/ {
  proxy_pass https://api.logspot.io/;
  proxy_set_header Host api.logspot.io;
  proxy_ssl_server_name on;
}

With this, https://yourdomain.com/_lg/i reaches https://api.logspot.io/i, and /_lg/identify and /_lg/consent resolve the same way.

Cloudflare (Workers)

Route a path on your zone to a Worker that forwards to Logspot:

export default {
  async fetch(request) {
    const url = new URL(request.url);

    if (url.pathname === '/lg.js') {
      return fetch('https://cdn.logspot.io/lg.js', request);
    }

    if (url.pathname.startsWith('/_lg/')) {
      const target =
        'https://api.logspot.io/' +
        url.pathname.slice('/_lg/'.length) +
        url.search;
      return fetch(target, request);
    }

    return fetch(request);
  },
};

Add routes for yourdomain.com/lg.js and yourdomain.com/_lg/* to the Worker. (You can do the same with a Cloudflare Rule → Origin Rule if you prefer no code.)

Verify It's Working

1. Load a page and open your browser's network tab.
2. Confirm lg.js loads from your domain and event requests POST to yourdomain.com/_lg/i (not api.logspot.io).
3. Open the Logspot dashboard — events should appear within seconds.

Related

• JS SDK reference — externalApiUrl and other init options
• Cross-domain tracking
• How Tracking & Identity Works