# Vector 5 Docs

> Cookieless analytics that measures humans, AI crawlers, and assistant referrals.

Host: https://docs.vector5.ai

## Pages

- [Introduction](https://docs.vector5.ai/introduction): Vector 5 is cookieless analytics that measures humans, AI crawlers, and assistant referrals — with a public collection manifest anyone can fetch.
- [Quick start](https://docs.vector5.ai/quick-start): Self-host Vector 5 with Docker Compose, add a site, and ship the tracker plus middleware in under ten minutes.
- [Concepts](https://docs.vector5.ai/concepts): The vocabulary Vector 5 uses everywhere: sites, actors, visitor hashes, rollups, manifests, and insights.
- [Architecture](https://docs.vector5.ai/architecture): A Go ingest API, a Next.js dashboard, Postgres, and four MIT client packages. One compose file. No extra workers.
- [Hosted vs self-host](https://docs.vector5.ai/hosted-vs-self-host): Same software. Invite-only cloud at vector5.ai, or Docker Compose on your metal.
- [Tracker script](https://docs.vector5.ai/tracker): A ~1 KB cookieless script. One tag before </head>. No cookies, no localStorage identifiers, no fingerprints.
- [Install on any stack](https://docs.vector5.ai/tracker/install): Drop v5.js into Next.js, WordPress, Shopify, Astro, Remix, SvelteKit, Webflow, or a raw HTML file.
- [Script attributes](https://docs.vector5.ai/tracker/attributes): data-domain, data-api, and data-hash. Everything else is inferred server-side.
- [Goals and custom events](https://docs.vector5.ai/tracker/events): Call window.v5, mark an element with data-v5-event, then create a matching goal in the dashboard.
- [SPAs and hash routing](https://docs.vector5.ai/tracker/spa): pushState, replaceState, and popstate are hooked automatically. Hash routing is opt-in.
- [Ignore your own visits](https://docs.vector5.ai/tracker/ignore): A single localStorage flag on your machine. The script never writes it — you do.
- [Next.js tracker](https://docs.vector5.ai/tracker/nextjs): Script in the root layout, middleware for crawlers, and optional hash tracking for docs.
- [WordPress](https://docs.vector5.ai/tracker/wordpress): Add v5.js to the theme head. Keep wp-admin out of the numbers.
- [Shopify](https://docs.vector5.ai/tracker/shopify): One tag in theme.liquid. Checkout pages are Shopify-hosted and will not run your script.
- [Server middleware](https://docs.vector5.ai/middleware): Crawlers and agents never load your script. @vector5/middleware inspects the user agent and forwards non-human requests to /api/hit.
- [Next.js middleware](https://docs.vector5.ai/middleware/nextjs): vector5() from @vector5/middleware/next. Edge-friendly, fire-and-forget, matcher-aware.
- [Express](https://docs.vector5.ai/middleware/express): app.use(vector5({ endpoint, domain })). Calls next() immediately.
- [Hono](https://docs.vector5.ai/middleware/hono): Works on Node, Bun, Deno, and Cloudflare via Hono middleware.
- [Cloudflare Workers](https://docs.vector5.ai/middleware/workers): Use ctx.waitUntil so the hit outlives the response.
- [Node HTTP](https://docs.vector5.ai/middleware/node): A function you call from http.createServer. It does not wrap the response.
- [recordHumans](https://docs.vector5.ai/middleware/record-humans): For sites without JavaScript. Counts every request, including browsers.
- [Actor classification](https://docs.vector5.ai/actors): Every event gets one of five actors. Classification happens server-side in Go and is deterministic.
- [AI crawlers](https://docs.vector5.ai/actors/crawlers): GPTBot, ClaudeBot, PerplexityBot, and the rest of the curated index.
- [human_via_ai](https://docs.vector5.ai/actors/human-via-ai): A person who arrived from ChatGPT, Perplexity, Claude, Gemini, Copilot, Grok, or DeepSeek.
- [AI agents](https://docs.vector5.ai/actors/agents): Headless browsers acting for a person. Task-oriented metrics, not bounce rate.
- [Generic bots](https://docs.vector5.ai/actors/bots): Uptime monitors, link previewers, Lighthouse, and everything else that looks automated.
- [Privacy model](https://docs.vector5.ai/privacy): Vector 5 measures audiences, not people. No cookies, no localStorage IDs, no fingerprints, no stored IPs.
- [Daily-salted visitor hash](https://docs.vector5.ai/privacy/visitor-hash): SHA-256 of daily salt, site id, IP, and user agent. The IP never hits disk.
- [Collection manifest](https://docs.vector5.ai/privacy/manifest): A public JSON document every site serves. Auditable by humans and agents.
- [Retention](https://docs.vector5.ai/privacy/retention): Site-level retention_days. Rollups outlive raw rows only as long as you keep them.
- [GDPR and CCPA](https://docs.vector5.ai/privacy/gdpr): No consent banner required for the default configuration. You still own the legal review.
- [Dashboard](https://docs.vector5.ai/dashboard): Sites, filters, goals, AI traffic, insights, and settings. Defaults to humans.
- [Sites](https://docs.vector5.ai/dashboard/sites): A site is a hostname. The tracker and middleware must use the same one.
- [Filters](https://docs.vector5.ai/dashboard/filters): days and actor. The same two query params the API and MCP use.
- [Goals](https://docs.vector5.ai/dashboard/goals): Named events with conversion rates that agents cannot inflate.
- [AI insights](https://docs.vector5.ai/dashboard/insights): Optional. The model only ever sees rollups. Ollama by default.
- [Realtime](https://docs.vector5.ai/dashboard/realtime): Humans in the last five minutes. Crawlers do not belong here.
- [AI traffic](https://docs.vector5.ai/dashboard/ai-traffic): Crawlers, assistant referrals, and the crawl-to-referral gap.
- [Settings](https://docs.vector5.ai/dashboard/settings): API keys, LLM provider, operator account, retention.
- [HTTP API](https://docs.vector5.ai/api): Ingest is public. Reads take a Bearer API key. days and actor filter most query routes.
- [Authentication](https://docs.vector5.ai/api/authentication): Admin JWT for the dashboard. API keys for scripts, MCP, and CI.
- [POST /api/event](https://docs.vector5.ai/api/event): Browser ingest. 202 on success. 404 if the domain is not a registered site.
- [POST /api/hit](https://docs.vector5.ai/api/hit): Server ingest from @vector5/middleware. Same 202 / 404 contract as /api/event.
- [Stats and realtime](https://docs.vector5.ai/api/stats): Totals, daily series, and humans in the last five minutes.
- [GET /api/sites/{id}/breakdown](https://docs.vector5.ai/api/breakdown): Top sources, pages, countries, or devices for a period and actor.
- [GET /api/sites/{id}/ai](https://docs.vector5.ai/api/ai): Crawlers, pages crawled, assistant referrals, and crawl-to-referral.
- [Goals API](https://docs.vector5.ai/api/goals): List, create, and delete goals. Conversions are always actor-aware.
- [Insights, anomalies, LLM](https://docs.vector5.ai/api/insights): Aggregates only. Configure the provider with PATCH /api/team/llm.
- [Export and import](https://docs.vector5.ai/api/export): JSON export of aggregates. CSV import for history.
- [Sites](https://docs.vector5.ai/api/sites): List, create, and patch sites. Domain is the join key for ingest.
- [API keys](https://docs.vector5.ai/api/keys): Team-scoped secrets for MCP, curl, and CI. Shown once.
- [GET /api/sites/{domain}/manifest](https://docs.vector5.ai/api/manifest): Public, unauthenticated, CORS-open. The machine-readable privacy policy.
- [GET /api/crawler-index](https://docs.vector5.ai/api/crawler-index): Public list of recognised AI crawlers. PRs welcome.
- [POST /api/waitlist](https://docs.vector5.ai/api/waitlist): Public early-access request for the hosted product.
- [MCP server](https://docs.vector5.ai/mcp): Give Claude, Cursor, or Codex read-only access to the same aggregates the dashboard shows.
- [MCP tools](https://docs.vector5.ai/mcp/tools): Six read-only tools. Input schema is days + actor.
- [Cursor, Claude, Codex](https://docs.vector5.ai/mcp/cursor): Drop the same server into any MCP host.
- [Agent skills](https://docs.vector5.ai/skills): Ready-made prompts in packages/skills. MIT. Copy them into Claude, Cursor, or Codex.
- [llms.txt](https://docs.vector5.ai/llms-txt): This docs site publishes /llms.txt and /llms-full.txt so assistants can ingest the corpus.
- [Self-hosting](https://docs.vector5.ai/self-host): A Go binary, a Next.js app, and Postgres. docker compose up --build runs all three.
- [Docker Compose](https://docs.vector5.ai/self-host/docker): postgres, api, web. Copy .env.example and compose up.
- [Local development](https://docs.vector5.ai/self-host/local): Go API + pnpm workspaces. Homebrew Postgres is fine.
- [Environment variables](https://docs.vector5.ai/self-host/environment): API, auth, web, and optional LLM. Nothing here is sent to the browser except NEXT_PUBLIC_*.
- [Supabase auth](https://docs.vector5.ai/self-host/supabase): V5_AUTH_MODE=supabase for multi-user cloud. Never put the service role in the browser.
- [Production hardening](https://docs.vector5.ai/self-host/production): TLS, secrets, backups, and the few things compose does not do for you.
- [Changelog](https://docs.vector5.ai/reference/changelog): What shipped. Dates are UTC.
- [Glossary](https://docs.vector5.ai/reference/glossary): The words the UI, API, and MCP all share.
- [FAQ](https://docs.vector5.ai/reference/faq): Short answers. The long ones live on the other pages.
- [Troubleshooting](https://docs.vector5.ai/reference/troubleshooting): Events missing, crawlers missing, 404 unknown site, empty insights.
- [Licence](https://docs.vector5.ai/reference/license): AGPL-3.0 for server and dashboard. MIT for tracker, middleware, MCP, and skills.
- [Compare](https://docs.vector5.ai/reference/compare): How Vector 5 differs from cookieless analytics that only run in the browser.
- [Architecture decisions](https://docs.vector5.ai/reference/decisions): The ADRs in docs/decisions. Short, accepted, dated.
- [Contributing](https://docs.vector5.ai/reference/contributing): DCO, crawler PRs, and how to run the docs app.

## Extra

- [Full corpus](https://docs.vector5.ai/llms-full.txt)
- [Product](https://vector5.ai)
- [GitHub](https://github.com/vector5-ai/analytics)