Reverse proxy

A reverse proxy can place Biqli’s browser endpoints under your hostname. This can improve first-party routing, but it does not bypass publishable-key or allowed-origin security.

Never proxy secret-key endpoints. Proxy only the browser click, client lead, and client sale routes.

Nginx example

Create one exact location per supported path:

location = /biqli/api/v1/track/click {
    limit_except POST OPTIONS { deny all; }
    client_max_body_size 32k;
    proxy_connect_timeout 3s;
    proxy_read_timeout 15s;

    proxy_pass https://biq.li/api/v1/track/click;
    proxy_set_header Host biq.li;
    proxy_set_header Origin $http_origin;
    proxy_set_header Cookie "";
    proxy_set_header X-Forwarded-Host "";
    proxy_set_header X-Original-URL "";
}

Create equivalent exact locations for:

/biqli/api/v1/track/lead/client
/biqli/api/v1/track/sale/client

Then configure the SDK:

new BiqliAnalytics({
  publishableKey: 'biqli_pk_xxxxxxxxx',
  apiHost: 'https://www.example.com/biqli',
});

Required security properties

Use exact paths and a fixed upstream.
Never accept an upstream host or URL from a header, query, or body.
Allow only POST and OPTIONS.
Limit request bodies to 32 KB.
Preserve Authorization, Content-Type, Idempotency-Key, and X-Biq-* headers.
Preserve the original browser Origin header.
Strip cookies and proxy-override headers.
Do not follow redirects to a different upstream.
Add edge rate limits in addition to Biqli’s limits.

The original Origin is essential. Biqli checks it against the workspace’s saved allowed hostnames. Replacing it with the proxy hostname would break that security boundary.

A reverse proxy must remain a narrow transport path. It must never become a general-purpose relay to arbitrary Biqli or third-party URLs.

GETTING STARTED

BROWSER TRACKING

SERVER TRACKING

INTEGRATIONS

OPERATIONS

Reverse proxy

Nginx example

Required security properties

​Nginx example

​Required security properties

Nginx example

Required security properties