Nuxt.js (v3.0 to v3.6)

Contents

PostHog makes it easy to get data about usage of your Nuxt.js app. Integrating PostHog into your app enables analytics about user behavior, custom events capture, session replays, feature flags, and more.

These docs are for Nuxt v3.0 to v3.6. You can see a working example of the Nuxt v3.0 integration in our Nuxt.js demo app

Setting up PostHog on the client side

  1. Install posthog-js using your package manager:

npm install --save posthog-js

If your site sets a Content-Security-Policy, it needs to allow PostHog. This applies to the snippet and to package installs alike: the SDK lazy-loads extra bundles (session replay, surveys) from PostHog's CDN, and sends events to the ingestion host. PostHog serves from subdomains of posthog.com that change over time, so allow the wildcard:

script-src 'self' https://*.posthog.com;
connect-src 'self' https://*.posthog.com;
worker-src 'self' blob: data:;

script-src covers the snippet and the lazy-loaded bundles, connect-src covers event ingestion and feature flags, and worker-src covers session replay. The toolbar needs a few more, or use a reverse proxy so everything is first-party. Failing to do so causes silent failures where capture and identify calls never send, so the integration looks complete while zero events arrive. Remember connect-src falls back to default-src, so default-src 'self' blocks event delivery even when the script itself is bundled.

  1. Store your PostHog key and host in environment variables rather than hard-coding them. Add them to a .env file (and to your hosting provider). You can find these in your project settings.
.env
NUXT_PUBLIC_POSTHOG_PROJECT_TOKEN=<ph_project_token>
NUXT_PUBLIC_POSTHOG_HOST=https://us.i.posthog.com

Then reference them in your nuxt.config.js file:

nuxt.config.js
export default defineNuxtConfig({
runtimeConfig: {
public: {
posthogToken: process.env.NUXT_PUBLIC_POSTHOG_PROJECT_TOKEN || '<ph_project_token>',
posthogHost: process.env.NUXT_PUBLIC_POSTHOG_HOST || 'https://us.i.posthog.com',
posthogDefaults: '2026-05-30',
},
}
})

Keep your personal API key out of the client bundle

Anything shipped to the browser – the token you pass to posthog.init(), anything under Nuxt's runtimeConfig.public, or the @posthog/nuxt module's posthogConfig – ends up in your client-side JavaScript and is visible to anyone who visits your site. This is fine for your project token (<ph_project_token>), which is designed to be public.

Your personal API key is different. It can grant full access to your PostHog account, so it must never reach the browser. If you need it – for example, for source map uploads or server-side local evaluation – read it from a server-only environment variable (or top-level runtimeConfig, never runtimeConfig.public) and only use it in server code.

Either way, prefer reading keys from environment variables rather than hard-coding them in nuxt.config, so you can keep them out of source control and use different values per environment.

  1. Create a new plugin by creating a new file posthog.client.js in your plugins directory.
plugins/posthog.client.js
import { defineNuxtPlugin, useRuntimeConfig } from '#imports'
import posthog from 'posthog-js'
export default defineNuxtPlugin(() => {
const runtimeConfig = useRuntimeConfig()
const posthogClient = posthog.init(runtimeConfig.public.posthogToken, {
api_host: runtimeConfig.public.posthogHost,
defaults: runtimeConfig.public.posthogDefaults,
loaded: (posthog) => {
if (import.meta.env.MODE === 'development') posthog.debug()
},
})
return {
provide: {
posthog: () => posthogClient,
},
}
})

PostHog can then be accessed throughout your Nuxt.js using the provider accessor, for example:

Vue
<script setup>
const { $posthog } = useNuxtApp()
if ($posthog) {
const posthog = $posthog()
posthog.capture('<event_name>')
}
</script>

See the JavaScript SDK docs for all usable functions, such as:

If your app calls your own backend, tracing_headers adds X-POSTHOG-DISTINCT-ID and X-POSTHOG-SESSION-ID to matching fetch and XMLHttpRequest requests. This lets server-side SDKs link backend events, errors, and LLM traces back to frontend sessions and replays. Use hostnames only, without protocols or paths.

JavaScript
posthog.init('<ph_project_token>', {
api_host: 'https://us.i.posthog.com',
// Optional: send PostHog session/user context to your backend
tracing_headers: ['api.example.com'],
})

This works in local development too, but match on the hostname alone: use 'localhost', not 'localhost:3000'. Ports are never part of a hostname, so a value with one in it never matches anything. localhost and 127.0.0.1 are also different hostnames — use whichever your app actually calls.

Tracing headers help you attribute events across front and backend consistently. When this isn't available, use your server-side stable IDs to deduce the matching distinctId, and pass it in when capturing the event.

Set up a reverse proxy (recommended)

We recommend setting up a reverse proxy, so that events are less likely to be intercepted by tracking blockers.

We have our own managed reverse proxy service, which is free for all PostHog Cloud users, routes through our infrastructure, and makes setting up your proxy easy.

If you don't want to use our managed service then there are several other options for creating a reverse proxy, including using Cloudflare, AWS Cloudfront, and Vercel.

Grouping products in one project (recommended)

If you have multiple customer-facing products (e.g. a marketing website + mobile app + web app), it's best to install PostHog on them all and group them in one project.

This makes it possible to track users across their entire journey (e.g. from visiting your marketing website to signing up for your product), or how they use your product across multiple platforms.

Add IPs to Firewall/WAF allowlists (recommended)

For certain features like heatmaps, your Web Application Firewall (WAF) may be blocking PostHog's requests to your site. Add these IP addresses to your WAF allowlist or rules to let PostHog access your site.

EU: 3.75.65.221, 18.197.246.42, 3.120.223.253

US: 44.205.89.55, 52.4.194.122, 44.208.188.173

These are public, stable IPs used by PostHog services (e.g., Celery tasks for snapshots).

Setting up PostHog on the server side

Install posthog-node using your package manager:

npm install posthog-node --save

Add your PostHog API key and host to your nuxt.config.js file, reading them from environment variables. If you've already done this when adding PostHog to the client side, you can skip this step.

nuxt.config.js
export default defineNuxtConfig({
runtimeConfig: {
public: {
posthogToken: process.env.NUXT_PUBLIC_POSTHOG_PROJECT_TOKEN || '<ph_project_token>',
posthogHost: process.env.NUXT_PUBLIC_POSTHOG_HOST || 'https://us.i.posthog.com',
posthogDefaults: '2026-05-30',
}
}
})

Initialize the PostHog Node client where you'd like to use it on the server side. For example, in a server route:

server/api/example.js
const runtimeConfig = useRuntimeConfig()
const posthog = new PostHog(
runtimeConfig.public.posthogToken,
{
host: runtimeConfig.public.posthogHost,
}
);
posthog.capture({
event: 'api_call',
distinctId: distinctID,
properties: {
$current_url: url,
query: query
}
})
posthog.shutdown()
return {
message: "example response"

Note: Make sure to always call posthog.shutdown() after capturing events from the server-side. PostHog queues events into larger batches, and this call forces all batched events to be flushed immediately.

See the Node SDK docs for all usable functions, such as:

Next steps

For any technical questions for how to integrate specific PostHog features into Nuxt (such as analytics, feature flags, A/B testing, surveys, etc.), have a look at our JavaScript Web and Node SDK docs.

Alternatively, the following tutorials can help you get started:

Community questions

Was this page useful?