> ## Documentation Index
> Fetch the complete documentation index at: https://learn.biq.li/llms.txt
> Use this file to discover all available pages before exploring further.

# Reverse proxy

> Forward browser tracking through a fixed endpoint on your own hostname.

A reverse proxy can place Biqli's browser endpoints under your hostname. This can improve first-party routing, but it does not bypass publishable-key or allowed-origin security.

<Warning>
  Never proxy secret-key endpoints. Proxy only the browser click, client lead, and client sale routes.
</Warning>

## Nginx example

Create one exact location per supported path:

```nginx theme={null}
location = /biqli/api/v1/track/click {
    limit_except POST OPTIONS { deny all; }
    client_max_body_size 32k;
    proxy_connect_timeout 3s;
    proxy_read_timeout 15s;

    proxy_pass https://biq.li/api/v1/track/click;
    proxy_set_header Host biq.li;
    proxy_set_header Origin $http_origin;
    proxy_set_header Cookie "";
    proxy_set_header X-Forwarded-Host "";
    proxy_set_header X-Original-URL "";
}
```

Create equivalent exact locations for:

* `/biqli/api/v1/track/lead/client`
* `/biqli/api/v1/track/sale/client`

Then configure the SDK:

```ts theme={null}
new BiqliAnalytics({
  publishableKey: 'biqli_pk_xxxxxxxxx',
  apiHost: 'https://www.example.com/biqli',
});
```

## Required security properties

* Use exact paths and a fixed upstream.
* Never accept an upstream host or URL from a header, query, or body.
* Allow only `POST` and `OPTIONS`.
* Limit request bodies to 32 KB.
* Preserve `Authorization`, `Content-Type`, `Idempotency-Key`, and `X-Biq-*` headers.
* Preserve the original browser `Origin` header.
* Strip cookies and proxy-override headers.
* Do not follow redirects to a different upstream.
* Add edge rate limits in addition to Biqli's limits.

The original `Origin` is essential. Biqli checks it against the workspace's saved allowed hostnames. Replacing it with the proxy hostname would break that security boundary.

<Note>
  A reverse proxy must remain a narrow transport path. It must never become a general-purpose relay to arbitrary Biqli or third-party URLs.
</Note>