Same-Origin Collector for Next.js / Vercel

If your site runs on Next.js (App Router) — on Vercel or anywhere else — you can add a small Route Handler instead of deploying a Cloudflare Worker to get the same result: visitors stay identified on Safari and iPhone for up to 400 days instead of 7.

Why a rewrite is not enough

A plain next.config.ts rewrites() entry forwards the request and passes cookies through, but it cannot add a header. Atribu only trusts the forwarded visitor IP and issues the atb_vid cookie when the request carries your Profile's proxy secret (x-atribu-proxy-secret) — a value that must never reach the browser. A rewrite has no way to attach it.

So the Next.js recipe is a real Route Handler: a few lines of server code that add the secret, forward the visitor's real IP, and relay Atribu's response — including its Set-Cookie — unchanged.

Setup

npm install @atribu/tracker

import { createAtribuProxy } from "@atribu/tracker/next";

export const { GET, POST } = createAtribuProxy({
  secret: process.env.ATRIBU_PROXY_SECRET!,
  path: "/atb",
});

ATRIBU_PROXY_SECRET=atbps_...

Do not use the Edge runtime

Do not add export const runtime = "edge"; to the route. The proxy needs the visitor's real IP, which it reads from x-forwarded-for / x-real-ip the way Vercel's Node.js functions receive them — the default runtime for a Route Handler, and the one this recipe is written for. The Edge runtime sits behind a different boundary and is not what this recipe was measured against.

Sharing the cookie across subdomains

By default the cookie belongs to the exact hostname the visitor is on. If your store spans www.yourstore.com and shop.yourstore.com, pass cookieDomain:

export const { GET, POST } = createAtribuProxy({
  secret: process.env.ATRIBU_PROXY_SECRET!,
  path: "/atb",
  cookieDomain: "yourstore.com",
});

What the proxy sends, and what it does not

Same rules as the Cloudflare Worker template — this recipe implements the identical contract:

• It forwards only what the tracker needs: the event, the browser's user agent and language, the page address, and the visitor's IP address.
• It forwards only Atribu's own atb_vid cookie. Your app's other cookies (auth sessions, carts) never leave your server.
• The proxy secret stays server-side. It is never sent to browsers, and Atribu stores only a fingerprint of it.
• Nothing here is cached — not by Next.js's own fetch cache, not by any CDN in front of your deployment. A cached collect response, or a cached script carrying another visitor's id, would be a real bug, so every outbound call the route makes uses cache: "no-store" and every response it returns sets Cache-Control: no-store (the tracker script itself is private, max-age=300 — short-lived and marked Vary: Cookie so it is never shared across visitors).

Reference

createAtribuProxy(config) returns { GET, POST } — the two functions your route file re-exports.

The module has no dependency on next — it is written against the standard Request/Response objects a Route Handler already uses, so next/server's NextRequest/NextResponse (which extend them) work too, and nothing framework-specific is required to call it in a test.

Next steps