Skip to main content
Diagram showing the reverse proxy architecture for a website with multiple frontends.

Using a reverse proxy with a single FPID (First-Party ID) cookie is the reference architecture for modern websites.

Using a reverse proxy on your website with a single FPID (First-Party ID) cookie is the reference architecture for modern websites:
  • Cookie Blocking: Safari’s Intelligent Tracking Prevention (ITP) allows cookies to work, but limits the lifetime of ones. A reverse proxy ensures that all cookies are set by the same origin.
  • Script Blocking: Privacy extensions and ad blockers often use domain-based blocklists. Content served from your own domain is less likely to be blocked than third-party hosted content.
  • SEO: Subdirectories consolidate link equity and domain authority more cleanly. All content shares the same origin, which can simplify your SEO strategy.
Using your own domain for data collection means sending data using the same IP address of your website, for all your frontend services:
ServiceBeforeAfter
Websitewww.example.comunchanged
Appapp.example.comwww.example.com/app/
Blogblog.example.comwww.example.com/blog/
Storestore.example.comwww.example.com/store/
Documentationdocs.example.comwww.example.com/docs/
Tag Servergtm.example.comwww.example.com/api/gtm/
This means dedicating a of your (FQDN) to each service.

​
Prerequisites

If you need support setting up a reverse proxy, you can contact us at [email protected].
  • You need admin access to your website hosting provider
  • You need admin access to your Google Tag Manager Server Container configuration
  • If you use multiple frontends (e.g. React website, WordPress blog, etc…), you need access to all of them

​
How it works

In order to use your domain to improve your data quality, you need to set up a reverse proxy on your website that forwards requests to your Google Tag Manager Server Container.
1

Configuring the reverse proxy

You can send events using your website own domain, by using a to serve all your customer-facing traffic.

2

Forwarding traffic to your Tag Manager Server Container

Request Forwarding
This step allows your Tag Manager Server Container to receive events from your website through your own domain.
You need to make sure that all requests to a subpath of your choosing, such as /api/gtm, are forwarded to your Google Tag Manager Server Container endpoint.The exact endpoint URL depends on your Tag Manager Server provider:
  • Google Cloud: Your server container URL (e.g., gtm-xxxxx-xxxxx.uc.r.appspot.com)
  • Stape: Your server container URL (e.g., gtm-xxxxx.stape.io)
  • Other providers: Consult your provider’s documentation
Cookie Forwarding
This steps allows your Tag Manager Server Container to manage cookies on your behalf, compliant with Apple® ITP requirements.
Make sure you also proxy the Cookie and Set-Cookie headers. This enables your Tag Manager Server Container to automatically manage cookies for you. Most reverse proxies will automatically forward all cookies by default.Although your Tag Manager Server Container ignores non-relevant cookies, if you operate in highly regulated industries, you can configure your reverse proxy to only forward cookies that are required for tracking to work properly:
  • FPID: (“First-Party ID”) The native Google Analytics 4® cookie holding the anonymousclient_id for the current browser
Headers Forwarding
This step allows OneView to:
  • identify you as a OneView customer
  • identify your traffic origin to apply region-specific regulations (e.g. GDPR, CCPA, etc…)
If OneView is not able to identify your traffic origin, the strictest regulation will be applied to your data.
RequiredHeaderValue
✅AuthorizationYour API key (e.g. Bearer <token>)
(optional)X-Forwarded-CountryRegionThe user’s country and region in a single ISO 3166-2 code (for example: US-CA)
(optional)X-Forwarded-CountryThe user’s country as an ISO 3166-1 alpha-2 code (for example: US)
(optional)X-Forwarded-RegionThe user’s region subdivision code (for example: CA). This is the second half of the ISO 3166-2 code (for example: US-CA)
You can configure geolocation headers at the load balancer or CDN level when you self-host.
ProviderSupportedGeolocation headers / methodDocumentation
AWS✅CloudFront-Viewer-Country, CloudFront-Viewer-Country-Region via Origin Request Policy📖 Guide
Google Cloud✅Custom headers using {client_country} and {client_region} variables📖 Guide
Azure✅ (partial)Azure Front Door only exposes the {geo_country} in its Rules Engine.📖 Guide
Cloudflare Enterprise✅Use Transform Rules to add visitor location headers📖 Guide
3

Update your frontend code

Update your frontend code to send events to your custom domain endpoint.If you’re using Google Tag Manager Web Container, configure it to send events to your server container at your custom domain:
gtag('config', 'G-XXXXXXXXXX', {
  'server_container_url': '/api/gtm',
});