First-party mount and site proxy
EdgeKit gives your organization one tenant host. It answers every EdgeKit request for every site your organization
runs, and it serves your organization only: its own database and its own sign-in instance, never shared with another
organization. The samples on these pages call it https://your-tenant-host.
Your pages should not call that host directly. Instead you route the /edgekit/ path on your site’s own domain to it,
so the page and EdgeKit share one origin. This is the first-party mount.
Why your own domain
Section titled “Why your own domain”- Cookies are first-party. The cookies EdgeKit sets, such as the user’s sign-in session, are set on your site’s host. A browser that blocks third-party cookies keeps them, and decide knows who the user is.
- Requests are same-origin. A same-origin request needs no CORS preflight, and a Content Security Policy with
connect-src 'self'already allows it. - Analytics stay on your origin. The EdgeKit tracker sends events to the page’s own origin by default, so there is no third-party host for a content blocker’s filter list to match.
- The origin check still applies. Browser requests to the client API and decide are checked against the site’s allowed origins, on your domain as on the tenant host. Analytics requests are not checked.
Three ways to connect a site
Section titled “Three ways to connect a site”| Setup | What you run | The user’s session | Use it when |
|---|---|---|---|
| Path mount | A rule on your CDN, load balancer or server that forwards /edgekit/ paths |
Sent | You can add path rules in front of your site |
| Tenant host directly | Nothing | Only on the same domain | You cannot route a path, and decisions for anonymous devices are enough |
| Site proxy | Your own copy of the site proxy, in front of your whole site | Sent | You cannot add path rules, or you want gated text removed before the page leaves your edge |
What you set in the console
Section titled “What you set in the console”Two things, whichever setup you choose:
- Allowed origins: open the site on Delivery › Delivery › Sites and list every origin your pages are served from. See Allow your site’s origins.
- A deploy: requests read the deployed configuration, not the draft, so a new site or a changed origin list applies only after you deploy on Delivery › Deployments › Versions.
Then verify the mount. If something answers an error, see Troubleshooting.