Integrate the Optimization Node SDK in a Node app
Overview
Use this guide to add Contentful personalization to a Node server you already have — an Express app,
a custom SSR server, or a server-side function — using @contentful/optimization-node. By the end
of the quick start, one route will emit a page event and report the profile the Experience API
returns for that request, without changing how your server fetches or renders content.
New to personalization? Here is the whole idea in five points:
- In Contentful you author variants of an entry and attach them to an experience — a rule that decides which visitors see which variant.
- On each request, Contentful’s Experience API looks at who the visitor is and picks the variant for each experience. Swapping a fetched entry for its picked variant is called resolving the entry.
- The Experience API also returns a profile: the anonymous, per-visitor identity and state used to keep personalization consistent across requests or app launches.
- Your app hands a Contentful entry to the SDK at the point where that entry becomes output. The SDK gives back the selected variant, or the original entry when no variant applies—the baseline fallback. You can fetch the entry yourself or give the SDK your Contentful client and an entry ID; either way, the client stays yours.
- You render the returned entry with the same application components you already use.
For the stateless Node SDK, your application persists the profile between requests.
That is enough to start. The guide introduces policy and optional capabilities at the point you need them.
You will get there in two milestones:
- Milestone 1 — an accepted page event and a profile for the request (the quick start below). A page event is accepted when your consent policy allows it and the Experience API responds; the response carries the profile and the request’s variant selections, and the route reports the profile ID. This is complete and shippable on its own.
- Milestone 2 — a resolved entry in the response (later). You fetch an entry, resolve it against the request’s selections, and render the returned variant or baseline. See Fetch and resolve Contentful entries.
This guide uses the ContentfulOptimization class from @contentful/optimization-node. You create
one instance for the whole process, then bind each incoming request to its own consent, locale, and
page context with forRequest(). Your app keeps ownership of its Contentful client, consent policy,
sessions, cookies, identity, routing, caching, and rendering — the Node SDK holds no per-visitor
state between requests.
The examples use Express, but the same request-scoped flow applies to any Node request handler. If you also want the browser to continue personalization after the server renders, see Share continuity with the Web SDK. For a browser-only app, use the Web SDK guide instead.
Quick start
Most Node + Contentful apps share one shape: a request handler builds a response and, somewhere in
it, an entry becomes rendered output. This quick start assumes that shape and proves the smallest
server-side result: one route reports an accepted page event and the profile the Experience API
returned for that request. It creates one process-level SDK instance, binds request-scoped consent
and page context with forRequest(), and calls page() from a route.
This quick start assumes your application policy permits Optimization by default and renders no
end-user consent UI. Consent has two independent parts you bind per request: events (may the SDK
send events and personalize this request) and persistence (may your app store the profile ID so
the same visitor stays consistent). The shorthand consent: true sets both to true; the object
form { events, persistence } sets them separately. If personalization must wait for a consent
decision, keep this structure and add the Apply consent policy step before
you ship.
Copy this:
Create server.mjs.
Copy this:
Start the app with your Optimization client ID.
Copy this:
In another terminal, verify the route.
Copy this:
The JSON response contains a profileId when page() is accepted — the Experience API evaluated
the request and returned a profile. An accepted event does not by itself prove a variant was chosen:
until you author a variant attached to an experience (see Before you start),
every request resolves to the baseline. To see a variant later, author an experience that targets
all visitors so every request matches it automatically, then resolve an entry as shown in
Fetch and resolve Contentful entries.
Before you start
The sections below walk the integration in order. First, gather the few things you can only get from outside this guide:
- A Node server you can add a route handler to, and its own Contentful fetching already working.
Install
expressonly if you are following the quick start verbatim; any Node request framework works. Installcontentfulif you want the SDK to fetch entries by ID and you do not already have a Delivery API client. - Contentful delivery credentials — space ID, delivery token, and environment — read from your server’s runtime configuration, never shipped to the browser.
- At least one entry with a variant attached to an experience, authored in Contentful. Without an authored variant, the integration can still run correctly while returning the baseline, so you cannot yet distinguish working personalization from a content-authoring gap. For the first personalized-content test, target all visitors so the test request or visitor matches automatically.
- Your Optimization project values — client ID and environment, from your Optimization project settings. The Experience API (which picks variants) and the Insights API (which receives event and interaction delivery) each have a base URL that defaults correctly; you only set them for mocks or non-default hosts (see Install and initialize the Node SDK).
You do not need a setup inventory up front. Everything else — consent, entry resolution, identity,
tracking, caching — is introduced by the section that needs it. The Node SDK holds no per-visitor
state between requests: it does not manage cookies, sessions, consent, long-lived profiles, or
rendering. Your app owns those and passes request inputs in; the SDK evaluates the request, resolves
entries, and returns request-local data. When you give it your delivery client, it can fetch entries
for you (managed fetching) via client.getEntry() for one entry or client.getEntries() for several.
Read the SDK config from your server’s runtime configuration. This guide’s examples read process.env values, and the reference implementations use PUBLIC_... names because they run against shared mock defaults; use whatever environment variable convention your deployment already uses and keep it consistent. Ship only the Contentful delivery token to any client, never a Management API token.
Core integration
Install and initialize the Node SDK
Integration category: Required for first integration
Create the SDK once for the Node process or module, then reuse that singleton across requests. Bind
request-specific inputs later with forRequest().
From here on, the guide’s examples are TypeScript, because the SDK’s request and result types are
most of the value in a server codebase. Run them with a TypeScript toolchain (for example tsx,
ts-node, or a build step) — or drop the type annotations to get back to plain .mjs like the quick
start. The quick start inlined the SDK inside server.mjs; the sections below factor initialization
into a small shared module (call it optimization.ts) that each route handler imports, so there is
still exactly one SDK instance per process.
- Install
@contentful/optimization-nodeandcontentfulwhen the SDK will fetch entries by ID. - Read the Optimization client ID and environment from your runtime configuration.
- Configure default locale and API endpoint overrides only when your app needs them.
- Export the singleton so route handlers can create request-bound SDK clients.
Copy this:
Adapt this to your use case: this is a new optimization.ts module you create; the route
handlers in later sections import { optimization } from it. Replace the env-var reads with your
app’s configuration mechanism.
Set api.experienceBaseUrl and api.insightsBaseUrl only for mock servers or non-default hosts;
they default correctly otherwise. See the env-var note in Before you start for
naming conventions.
Bind request context and locale
Integration category: Required for first integration
Build request context for every incoming request. The context gives SDK events a stable page or
route description, user agent, and locale. The request-scoped locale also sets the Experience API
locale query parameter.
- Choose the application Contentful locale in your router, i18n layer, or request policy.
- Pass the same locale to Contentful CDA requests and to
forRequest({ locale: appLocale })when Experience API responses and events need to use the same language. - Derive page context from the current request instead of sharing it across requests.
Adapt this to your use case:
Later snippets call getAppLocale(req) — that is your app’s per-request locale decision (from step
1), which can be as simple as a single const APP_LOCALE = 'en-US' if your app is single-locale.
Wherever you see getAppLocale(req), substitute your own locale source.
For the full locale model, see Locale handling in the Optimization SDK Suite.
Apply consent policy
Integration category: Common but policy-dependent
Consent belongs to your application layer. The Node SDK accepts the request-scoped decision through
forRequest({ consent }).
The snippets here and in the next section call getProfileFromRequest(req) and persistProfile(res, id) — the read and write halves of profile continuity. They are defined in
Persist profile identity between requests; if you are
building top to bottom, treat them as undefined/no-ops until you reach that section.
- If application policy permits Optimization by default and no end-user consent UI is rendered,
bind each request with
{ events: true, persistence: true }. - If consent depends on user choice, read that decision from your consent cookie, session, CMP, or preference store before making SDK calls.
- Persist returned profile IDs only when
requestOptimization.canPersistProfileistrue. - When consent is revoked, clear the stored anonymous ID and stop sending further Optimization traffic until consent is granted again.
Copy this:
Adapt this to your use case:
By default, the Node SDK admits request-bound identify() and page() before event consent is
granted, and labels those events with context.gdpr.isConsentGiven: false. Configure
allowedEventTypes: [] if your policy requires strict opt-in before all stateless events.
Evaluate route requests with page()
Integration category: Required for first integration
Call page() for the server route or request that needs profile evaluation, variant selections, or
Custom Flag changes. Render from the accepted event result for the current request.
An accepted page() returns three things your render logic uses:
profile— the anonymous per-visitor identity and state (defined in the intro).selectedOptimizations— the whole set of variant selections the Experience API made for this request, one per matched experience. You pass this set into entry resolution.changes— the computed Custom Flag values for this request. A Custom Flag is a named value you author against an experience in Contentful (a feature toggle, a string, a number) and read at runtime, instead of swapping a whole entry. See Read Custom Flags.
- Create a request-bound SDK client inside the route handler.
- Call
page()before resolving personalized entries for that response. - Use
result.acceptedandresult.datato handle consent-blocked or unavailable data paths. - Pass returned
profile,selectedOptimizations, andchangesto downstream render logic.
This route is the quick start’s handler with three additions: it gates consent on the app’s real
decision (allowed), persists the profile only when canPersistProfile is true, and returns
selectedOptimizations and changes alongside the profile.
Adapt this to your use case:
The SDK does not expose direct event methods on the singleton. Call event methods on the object
returned by forRequest().
Identify known users
Integration category: Common but policy-dependent
Call identify() when your request has a known user ID from an application-owned identity source.
The Node SDK does not choose the identity key or fetch traits for you.
- Read the known user ID from authentication middleware, a session, a JWT, or an upstream account service.
- Bind the current anonymous profile ID, if one exists, with
forRequest({ profile }). - Call
identify()when the user is known and your consent policy permits that event. - Render from the response object that best matches the user state for the current response.
Adapt this to your use case:
Call identify() before page() when the current page view must be attributed to the known user.
Call page() before identify() when the request arrived anonymous but the response can still use
data returned from the identify step. In either order, render from the response that represents the
state you want on the page.
Persist profile identity between requests
Integration category: Common but policy-dependent
The Node SDK is stateless, so it does not remember a visitor between requests. Persist only the
profile ID that your consent policy allows, then pass it back through forRequest({ profile }).
- Choose an application session or first-party cookie for profile continuity.
- Install cookie parsing middleware or use your framework’s existing cookie/session reader.
- Read the stored ID at the start of each request.
- Persist the returned
profile.idonly whenrequestOptimization.canPersistProfileis true. - Clear the stored ID when consent is denied or revoked.
Adapt this to your use case:
ANONYMOUS_ID_COOKIE is an SDK-defined constant that resolves to the cookie name ctfl-opt-aid;
import it rather than hardcoding the string, and do not rename it — the browser Web SDK reads the
same name. Use this shared cookie when the same app also runs the Web SDK in the browser, and do not
mark it HttpOnly in a hybrid Node + Web SDK app because browser-side SDK code must read it. In a
server-only app, a session store or a stricter cookie policy can be valid.
For the lower-level mechanics, see Profile synchronization between client and server.
Fetch and resolve Contentful entries
Integration category: Required for first integration
Your app owns the Contentful delivery client, credentials, and delivery policy. The preferred
Contentful path passes an app-owned contentful.js client to the SDK, then calls the request-bound
requestOptimization.fetchOptimizedEntry(entryId) helper after page() or identify().
This is Milestone 2: the quick start proved an accepted event and a profile; here you turn that into
a rendered variant. The one genuinely new call is requestOptimization.fetchOptimizedEntry(entryId),
which fetches the baseline entry, resolves the selected variant, and uses the latest accepted
Experience response selections when you omit selectedOptimizations. For several known entry IDs at
once, requestOptimization.fetchContentfulEntries() and requestOptimization.prefetchManagedEntries()
batch the fetch — entries sharing a normalized query go through one getEntries() call, split into
100-ID chunks when large.
Two similarly named values appear from here on, and the one-letter difference is intentional:
selectedOptimizations(plural) is the request’s whole set of selections frompage()— what you pass into resolution.selectedOptimization(singular) is the one selection the resolver returns for a specific entry: which experience and variant index applied to it. Use it for tracking and analytics.
- Configure the SDK with
contentful: { client, defaultQuery?, cache? }(done once in youroptimization.tsmodule from Install and initialize the Node SDK). - Call
page()oridentify()before resolving entries for the response. - Call
requestOptimization.fetchOptimizedEntry(entryId)inside the request handler. - Render the returned
entry. If resolution cannot find a matching optimization or variant, the resolver returns the baseline entry.
Adapt this to your use case: the SDK config below repeats the optimization.ts module from the
install section so the contentful.client requirement is visible in one place — reuse your existing
instance rather than creating a second one. The route handler is the new part.
Use requestOptimization.fetchOptimizedEntry() in request handlers. If you call
optimization.fetchOptimizedEntry() on the singleton for personalized content, pass
selectedOptimizations explicitly.
Use manual baseline-entry fetching plus resolveOptimizedEntry() when the app needs custom delivery
behavior, GraphQL, REST without contentful.js, or an already-fetched baseline entry:
Adapt this to your use case:
Do not configure SDK-managed fetches or manual fetches with contentful.js withAllLocales or raw
CDA locale=* responses. The resolver expects direct single-locale field values such as
fields.nt_experiences and fields.nt_variants. For the entry contract, see
Entry personalization and variant resolution.
Optional integrations
Resolve merge tags
Integration category: Optional
Use this helper when your Contentful content contains MergeTag entries. A MergeTag is an authored
placeholder embedded in Rich Text (for example a visitor’s first name or city) that the SDK fills in
from the request’s profile at render time, falling back to a default value when the profile has no
value for it.
- Detect MergeTag entries in your Rich Text renderer.
- Resolve each MergeTag entry against the current request’s
profile. - Render the fallback value when no profile value exists.
- Keep merge-tag-rendered output request-local because it depends on profile data.
Adapt this to your use case:
If MergeTags reference localized profile fields such as location.city or location.country, pass
the same application locale to Contentful fetches and forRequest({ locale }) so profile values and
entry language line up. For SDK-managed entry fetching on a request-bound client,
forRequest({ locale }) supplies the managed Contentful query locale when neither
contentful.defaultQuery nor the per-call query sets locale.
Read Custom Flags
Integration category: Optional
Use this helper when your Experience response includes Custom Flag changes.
- Read flags from the accepted Experience response’s
changes. - Render the server response from the returned flag value.
- Emit a flag-view event explicitly when your reporting policy needs a flag exposure.
The flag name you pass to getFlag() and componentId ('new-navigation' below) must match the
Custom Flag key you authored in Contentful — it is not a free-choice label. getFlag() returns the
authored value, so type its use to your flag (here, comparing against true for a boolean flag).
Copy this:
Adapt this to your use case:
In the stateless Node SDK, getFlag() does not auto-track flag views.
Track server-side interactions and business events
Integration category: Optional
Use request-bound event methods when the server owns an exposure, action, or business event. Browser clicks and hovers are usually better emitted from browser SDK code because the browser observes the real interaction.
- Bind consent, locale, event context, and profile for the request or server action.
- Use
track()for custom business events. - Use
trackView()when the server knows exactly which optimized entry was rendered. - Bind a profile for Insights-only calls such as non-sticky
trackView(),trackClick(),trackHover(), andtrackFlagView().
Unlike a Custom Flag key, the track() event name and its properties are your own free-choice
labels — pick names that fit your analytics plan; they do not need to match anything authored in
Contentful.
Adapt this to your use case:
Adapt this to your use case:
Sticky trackView() sends an Experience event first and can reuse the returned profile for the
paired Insights event. Non-sticky trackView() and the Insights-only methods require a
request-bound profile ID because the Node SDK has no ambient profile state.
For the lower-level mechanics, see Interaction tracking in Node and stateless environments.
Forward optimization context to analytics
Integration category: Optional
Use this integration when your Node app already sends server-side events to an analytics, customer-data, or tag-management destination. The Optimization SDK still sends events to Contentful; your application decides which approved Contentful context, if any, can also be forwarded.
- Use request-local data from the SDK call that belongs to the server request or action.
- Add selected Optimization fields to the same analytics event that already owns the business action.
- Gate both Contentful and third-party delivery with the same application consent policy.
- Prevent duplicate forwarding when the browser also sends a later client-side event for the same interaction.
Adapt this to your use case:
Use Forwarding Optimization SDK context to analytics and tag-management tools for request-local mapping, vendor examples, consent, identity, deduplication, and governance guidance.
Share continuity with the Web SDK
Integration category: Optional
Add @contentful/optimization-web when the browser also needs to participate after server render.
Use the Node SDK alone when the server chooses the variant and renders the full response.
- Store the shared anonymous profile ID in
ANONYMOUS_ID_COOKIEwhen consent permits persistence. - Leave the shared cookie readable by browser-side code in hybrid Node + Web SDK apps.
- Initialize the Web SDK with the same Optimization client, environment, and application locale.
- Let browser code handle later client-side consent, page events, entry interactions, and live updates.
The Node SDK does not provide browser live updates or a preview UI. Keep those concerns in browser-side SDK code or app-owned Contentful preview tooling.
The Node SSR + Web SDK reference implementation
shows cookie sharing with ANONYMOUS_ID_COOKIE plus browser-side follow-up tracking and entry
resolution.
Advanced integrations
Control pre-consent event admission and request options
Integration category: Advanced or production-only
Use this section when your policy or deployment needs stricter consent behavior, diagnostics, or per-request API options.
- Configure
allowedEventTypes: []to block all events before event consent is granted. - Configure a narrower or wider allowlist only after your privacy policy approves those event types.
- Use
onEventBlockedfor diagnostics when consent blocks a request-bound event call. - Use request-scoped
experienceOptionsandinsightsOptionsfor advanced API behavior such aspreflight, IP override, or a custom Insightsbeaconsender.
Follow this pattern:
If both locale and experienceOptions.locale are supplied to forRequest(), the request-scoped
top-level locale wins.
Keep caches safe for personalized rendering
Integration category: Advanced or production-only
The Node SDK sits on one side of an important cache boundary: your app fetches Contentful content, the SDK evaluates the current request, and your app resolves and renders the selected variant. Cache raw Contentful delivery payloads broadly; keep profile-evaluated output request-local unless your cache varies on every personalization input.
- Cache baseline Contentful entries or query results by entry, query, locale, include depth, environment, host, and delivery mode.
- Treat cached Contentful entries as immutable, or clone them before request-specific transforms such as merge-tag rendering.
- Resolve variants from the current request’s
selectedOptimizations, or userequestOptimization.fetchOptimizedEntry()so the request-bound helper supplies them. - Render MergeTags against the current request’s
profile. - Do not memoize
page(),identify(),track(), ortrackView()results as if they were pure reads.
Use this cache-safety table when planning production caching:
Production checks
Before releasing a Node SDK integration, verify these points:
- Credentials and runtime configuration: the deployed runtime has the Optimization client ID, environment, API endpoint overrides if needed, Contentful delivery credentials, and the same Node runtime support you validated locally.
- Consent behavior: default-on requests bind
{ events: true, persistence: true }only when policy permits it, user-choice flows bind the actual request decision, and revoked consent clears stored profile IDs. - Event delivery:
page()andidentify()return accepted results in allowed paths, blocked paths fail closed, andonEventBlockedor server logs expose consent-blocked diagnostics during rollout. - Content fallback behavior: baseline entries render when
selectedOptimizationsis missing, entries are not optimized, linked optimization entries are unresolved, or a selected variant cannot be found. - Duplicate tracking prevention: server-rendered exposures, browser follow-up tracking, and third-party forwarding have one owner per event in your tracking plan.
- Privacy and governance constraints: profile IDs, full profile objects, selected optimizations, changes, and analytics payloads are forwarded only to approved destinations.
- Local validation path: run the server against mock or test credentials, load a route that calls
page(), verify a returnedprofile.id, render an optimized entry, and verify the baseline fallback path by testing withoutselectedOptimizations.
Troubleshooting
Reference implementations to compare against
Use these reference implementations when you want working repository examples instead of guide snippets:
- Node SSR Only: server-only SSR flow with
page(),identify(),resolveOptimizedEntry(),getMergeTagValue(), raw Contentful entry caching, and single-locale CDA requests. - Node SSR + Web SDK Vanilla: consent-aware
cookie sharing with
ANONYMOUS_ID_COOKIEfor Node and Web SDK continuity, plus browser-side follow-up tracking and entry resolution.