Skip to content
nowyourlink Docs

Process — /go/{auction_id} click-tracking redirect

Process — /go/{auction_id} click-tracking redirect

Section titled “Process — /go/{auction_id} click-tracking redirect”

Source: docs/superpowers/specs/2026-05-23-07-public-site-archive-design.md §6. Anonymises the visitor, fires a click log to apps/api, and 302s to the advertiser’s URL with UTM params. Anonymisation follows research/astro-cf-monorepo-patterns.md §9 (truncated IP + daily-salted SHA-256).

A click route checks the settled Spotlight, constructs the advertiser URL with campaign attribution, records a privacy-limited click event and redirects without caching. Bot clicks are redirected but excluded from advertiser metrics.A click route checks the settled Spotlight, constructs the advertiser URL with campaign attribution, records a privacy-limited click event and redirects without caching. Bot clicks are redirected but excluded from advertiser metrics.

Key invariants:

  • The redirect is never blocked by Turnstile — UX trumps; abuse is mitigated downstream by bot tagging and aggregate suppression.
  • The click log is fired with ctx.waitUntil so the 302 is not delayed by the log path.
  • Raw IP is never persisted; only the truncated + salted hash leaves the worker.
  • House-ad days return 404 (no advertiser to redirect to), preventing accidental UTM-rewriting of internal URLs (E1).
  • The consumer dedupes on (visitor_id, auction_id, hour_bucket) so a refresh storm counts as one click per hour.