Same-Origin Collector

Serve Atribu's tracker from a path on your own website (for example yourstore.com/atb) so Safari and iPhones keep recognizing returning visitors for up to 400 days instead of 7.

Why this matters

Safari's Intelligent Tracking Prevention (ITP) deletes anything a script stores in the browser after 7 days — and after just 24 hours when the visitor arrived from an ad click. Roughly half of most stores' traffic is Safari or an in-app browser on iPhone. Without this setup, someone who clicks your ad today and buys two weeks later looks like a brand-new visitor, and the sale cannot be tied back to the ad.

A custom tracking domain (t.yourstore.com) does not fix this. It gets past ad blockers, but Safari also limits cookies set by a server on a different network from your site, and a CNAME to collect.atribu.app is exactly that.

The same-origin collector is the fix: a small proxy on your own site forwards tracking requests to Atribu, and Atribu's answer sets a secure, server-side cookie (atb_vid) that Safari leaves alone.

Your dashboard shows which one a profile is on under Settings > Tracking > Domains.

Setup with a Cloudflare Worker

You need your site on Cloudflare (orange-cloud proxied). Any plan works, including Free.

yourstore.com/atb/*

Command-line deploy

If you deploy Workers with Wrangler, copy wrangler.toml.example next to worker.js, replace your-shop.com, then run npx wrangler secret put ATRIBU_PROXY_SECRET and npx wrangler deploy.

Sharing the cookie across subdomains

By default the cookie belongs to the exact hostname the visitor is on. If your store spans www.yourstore.com and shop.yourstore.com, set ATRIBU_COOKIE_DOMAIN to yourstore.com in the Worker.

What the proxy sends, and what it does not

• It forwards only what the tracker needs: the event, the browser's user agent and language, the page address, and the visitor's IP address (so location and fraud checks keep working).
• It forwards only Atribu's own atb_vid cookie. Your store's other cookies (logins, carts, sessions) never leave your site.
• The proxy secret stays inside the Worker. It is never sent to browsers, and Atribu stores only a fingerprint of it.
• atb_vid holds a random visitor ID — no personal data. Signing out a visitor with atribuTracker.reset() also replaces it.

For developers: the proxy contract

Any reverse proxy on your own origin can do the same job. If your site runs on Next.js / Vercel, see the dedicated recipe — a small Route Handler using @atribu/tracker/next, no Cloudflare account needed. For anything else, a proxy must:

1. Serve GET <path>/atribu-tracker.js from https://www.atribu.app/atribu-tracker.js. Optionally prepend window.ATRIBU_TRACKING_ENDPOINT = location.origin + "<path>/api/tracking/collect"; and, when the request has an atb_vid cookie, window.ATRIBU_SERVER_ANON_ID = "<its value>";.
2. Forward <path>/api/tracking/* to https://www.atribu.app/api/tracking/* with the same method, query and body, plus these request headers:

3. Never pass through x-atribu-* or x-forwarded-for headers that came from the browser.
4. Return Atribu's response unchanged — including its Set-Cookie: atb_vid=… header.

Atribu trusts the forwarded IP and cookie only when the secret matches the profile the tracking key belongs to. Without it, the request is processed like any other: no cookie is set.

Next steps