Leave out your own servers

A call your own server makes is not a visitor or an agent. A page rendered on your server that reads your API through the edge records a step for every read, all from a few addresses at a steady rate. Those steps crowd out the journeys you want to see. So leave them out. Have your servers send a secret on their own calls, then send any request that carries it straight to your site.

On the edge

Check the header in your own handler, and only hand other requests to the edge:

export default {
  fetch(request, env, ctx) {
    if (request.headers.get('x-my-internal') === env.OWN_SERVERS_VALUE)
      return fetch(request);
    edge ??= createEdge({
      // ...
    });
    return edge.handle(request, cloudflare(ctx));
  },
};

A request that matches goes to your site without passing through the edge, so nothing is recorded of it.

Why a secret

Check something only your servers can send. Any caller can send any user agent, and an address is shared by everything behind it. If you skip by either, a caller that matches is never recorded, and you never find out. A shared secret is the one thing a caller cannot claim. Use a long random value, keep it in your platform’s secrets, and compare it in constant time where your platform offers that.

Get started

Set up

Test agents

Observe activity

Hear from agents

Ask

Team

Leave out your own servers

On the edge

Why a secret

​On the edge

​Why a secret

On the edge

Why a secret