1

We are working on an Open Source Chrome extension: Digital Assistant Client

I'm trying to send event and page view data to Google Analytics 4 (GA4) without using the gtag.js script or Google Tag Manager.

Instead, I followed the official documentation to use the Measurement Protocol API:

🔗 https://developers.google.com/analytics/devguides/collection/protocol/ga4/sending-events

However, when making requests from the frontend, I'm running into CORS issues, and I also don’t want to expose my Measurement Protocol API secret key in the browser. Is there a recommended or secure way to send GA4 data without using gtag.js, Tag Manager, or exposing the API secret on the frontend?

Any help or suggestions would be greatly appreciated!

5
  • developers.google.com/analytics/devguides/collection/protocol/…: "Key Point: The intent of the Measurement Protocol is to augment automatic collection through gtag, Tag Manager, and Google Analytics for Firebase, not to replace it." - so can you explain, what exactly you're trying to achieve here? Commented Jul 21 at 8:10
  • I am trying to integrate google analytics in my chrome extension. But due to manifest v3 i cannot add external scripts into the plugin. So trying to collect the data via xhr and i was facing cors issue. Commented Jul 21 at 9:37
  • "I am trying to integrate google analytics in my chrome extension." - not sure what that is actually supposed to mean. "So trying to collect the data via xhr and i was facing cors issue." - that probably means, either this endpoint isn't meant for client-side consumption at all (highly possible, for stuff that requires any sort of secret as a parameter); or perhaps it is tied to an Origin via the client ID - which in the context of your extension, isn't given. Commented Jul 21 at 9:46
  • @C3roe can we send analytics directly to collect API via fetch from frontend without causing cors issue? Earlier i was using react-ga npm package but from recent changes at chrome webstore integrating gtag script which is from external is not accepted as per mv3. So was trying to integrate directly. If you have any solution please let me know Commented Jul 24 at 4:25
  • The call appears to need the app secret, and that should never be exposed in publicly available, client-side code. You'd have to use a server under your control as a CORS proxy then. Commented Jul 24 at 7:23

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.