createFlowmarkProxy

Imports and signatureCopy Anchor Link

import { createFlowmarkProxy } from "@flowmarkdev/node/proxy"
// Also exported from "@flowmarkdev/node/next/proxy".

// createFlowmarkProxy(config?: FlowmarkProxyConfig):
//   (request: Request) => Promise<Response>

This is a Web Request/Response handler, not a Next.js-only wrapper.

ExampleCopy Anchor Link

// app/api/flowmark/route.ts
import { createFlowmarkProxy } from "@flowmarkdev/node/next/proxy"

export const POST = createFlowmarkProxy({
  authorize: async (request) => await canRecordWorkflow(request),
})

canRecordWorkflow is your application's authentication/rate-limit check; Flowmark does not supply it. The browser uses createFlowmark({ proxyPath: "/api/flowmark" }) from the browser entry.

OptionsCopy Anchor Link

Authorization runs before body parsing. Add it before exposing the route; same-origin checks are not authentication or rate limiting. false denies the request. Thrown authorization errors are logged and return 502.

Request and response behaviorCopy Anchor Link

The handler requires POST, a matching Origin, and no cross-site Fetch Metadata. It validates the event envelope and bounds streamed bodies to 64 KiB. It adds the server's key and sends to private /v1/events.

Private-route forwarding does not make browser reports trustworthy. Do not use them as proof of payments or business identity.