Proxy Session Replay requests

Proxy Session Replay requests when you need SDK network traffic to pass through your own domain before reaching Amplitude. In the browser, you can proxy requests independently of hosting the browser script. The iOS and Android SDKs support a custom URL for replay uploads.

Proxy API calls

Route SDK network requests through your own server so they don't go directly to amplitude.com endpoints. Your proxy server receives the request, forwards it to Amplitude's default endpoint, and returns Amplitude's response unchanged.

How the proxy works

A minimal proxy implementation should:

1. Accept requests from the SDK at your custom URL.
2. Forward the full request body and all headers (except Host) to the corresponding Amplitude endpoint.
3. Return Amplitude's response to the SDK unchanged, including the status code, headers, and body.

Your proxy should be transparent. Don't strip, modify, or buffer the request or response payload. The SDK handles retries, so your proxy doesn't need to.

Optional Analytics SDK proxy

Analytics SDKs use separate ingestion and remote configuration endpoints. If your implementation also captures Analytics events, go to Proxy Analytics SDK requests.

Session Replay: Browser (Plugin and Standalone SDK)

Session Replay sends captured data and fetches remote configuration through separate endpoints. Forward each request to the corresponding API endpoint for your region.

Session Replay Plugin:

sessionReplayPlugin({
  trackServerUrl: 'https://replay.yourdomain.com/sessions/v2/track',
  configServerUrl: 'https://replay.yourdomain.com/config'
});

Session Replay Standalone SDK:

sessionReplay.init('API_KEY', {
  trackServerUrl: 'https://replay.yourdomain.com/sessions/v2/track',
  configServerUrl: 'https://replay.yourdomain.com/config'
});

Session Replay: Mobile (iOS and Android)

The iOS and Android SDKs send replay uploads to your proxy when you set a custom server URL. Point the SDK at the full upload URL on your proxy, and have the proxy forward each request to https://api-sr.amplitude.com/sessions/v2/track (US) or https://api-sr.eu.amplitude.com/sessions/v2/track (EU) with the query string, headers, and body unchanged. A custom server URL overrides serverZone.

The mobile SDKs fetch remote configuration directly from Amplitude. They don't support a custom remote configuration URL yet.

iOS plugin:

let config = AmplitudeSwiftSessionReplayPlugin.Config(
    sampleRate: 1.0,
    uploadConfig: UploadConfig(serverUrl: "https://replay.yourdomain.com/sessions/v2/track")
)
amplitude.add(plugin: AmplitudeSwiftSessionReplayPlugin(config: config))

Android plugin:

val sessionReplayPlugin = SessionReplayPlugin(
    context = applicationContext,
    sampleRate = 1.0,
    serverUrl = "https://replay.yourdomain.com/sessions/v2/track"
)
amplitude.add(sessionReplayPlugin)

Android middleware:

val sessionReplayMiddleware = SessionReplayMiddleware.Builder(amplitude)
    .sampleRate(1.0)
    .serverUrl("https://replay.yourdomain.com/sessions/v2/track")
    .build()
amplitude.addEventMiddleware(sessionReplayMiddleware)

The React Native and Flutter Session Replay SDKs don't support custom proxy URLs. Their serverZone option selects Amplitude's US or EU data center, and requests go directly to Amplitude.

Content Security Policy (CSP)

If your app sets a Content Security Policy, update it when switching to self-hosted files and proxied endpoints.

Example CSP (fully self-hosted):

Content-Security-Policy: script-src 'self' https://assets.yourdomain.com; connect-src 'self' https://analytics.yourdomain.com https://replay.yourdomain.com; worker-src 'self' blob:;

Because your proxy handles routing to Amplitude's US or EU endpoints, the CSP only needs to reference your own domain. The same policy works for both regions.