Analytics sponsors can trust.

Features

Projects, campaigns and links

Organize work by client. Rat creates a tracking link for each of ten platforms when you add a campaign. You can add custom links by hand.

Click tracking

Every short link redirects and records the time, country, device, OS, browser and referrer. Rat flags bots.

Analytics dashboard

View platform efficiency, global reach, a golden-hour heatmap, loyalty and velocity over 24 hours, 7 days or 30 days. Export clicks as CSV or JSON.

Sponsor kit

Check traffic quality, geo value, decay and deal value for each campaign. Share the results with sponsors through a read-only report link.

Audience counts

Rat reads follower counts from public YouTube, Instagram and X pages. A Twitch adapter is optional.

Self-hosted, MIT licensed

Run the Laravel API, Next.js app and MongoDB on your own infrastructure.

Country lookup

Connect the free MaxMind GeoLite2 City database to see which country each click came from. Without it, country data shows as unknown.

Repeat visitors

Turn on visitor tracking to count repeat visitors with a signed first-party cookie instead of IP addresses. It's off by default.

Traffic quality certificate

A grade from A to D based on the share of verified human clicks. Rat counts bots, unclassified traffic, rapid bursts and repeat clicks separately.

Geo value score

Weights human clicks by country using advertising-value tiers. Clicks from higher-value markets carry more weight.

Decay curve and long tail

How clicks build up after a placement goes live, and how much traffic still arrives after day 7 and day 30.

Deal value

Enter what the sponsor paid to see the effective cost per click next to Meta, Google Search, TikTok, YouTube and LinkedIn ads.

Edit benchmarks, exchange rates, geo tiers and grade thresholds to fit your market, and treat the benchmarks as estimates.

your-domain.com/r/8f3c1e…

Hashed tokens

Rat stores report tokens as SHA-256 hashes and shows the full URL only once.

No search indexing

Report pages ask search engines not to index them, and never pass their private link on to other sites.

No sign-in

Sponsors open the link directly. The public endpoint allows 60 requests a minute.

1. 01

   01Get the code and start MongoDB

   $ git clone https://github.com/jordansmalls/rat$ cd rat$ docker compose up -d  # optional: MongoDB on :27017, Mailpit on :8025

2. 02

   02Set up the API

   $ cd api$ cp .env.example .env$ composer setup  # dependencies, APP_KEY and MongoDB indexes

   .env.example points at a local MongoDB. To use Atlas, set MONGODB_URI and MONGODB_DATABASE.

3. 03

   03Set up the web app

   $ cd ../web$ pnpm install$ cp .env.example .env.local

4. 04

   04Start Rat

   $ cd ../api$ composer dev

   Starts the API on :4000, a queue worker, the log viewer and Next.js on :3000. Open localhost:3000, create an account, choose a handle and add your socials.

5. +

   +Load sample data

   $ php artisan rat:seed-demo --email=you@example.com

   Adds fictional projects, campaigns and clicks to your account without replacing existing data. You can rerun it. Use --dry-run to see what it would insert.

1. 01

   01Configure the API

   APP_ENV=productionAPP_DEBUG=falseAPP_URL=https://go.example.comBASE_URL=https://go.example.comFRONTEND_URL=https://app.example.comSANCTUM_STATEFUL_DOMAINS=app.example.comSESSION_SECURE_COOKIE=trueTRUSTED_PROXIES=…  # the Next.js server and any load balancer or CDNMONGODB_URI=mongodb+srv://…MONGODB_DATABASE=rat

   Add these settings to api/.env. Set BASE_URL before creating links. Each link stores its full URL at creation.

2. 02

   02Install the API

   $ cd api$ composer install --no-dev --optimize-autoloader$ php artisan key:generate     # first deploy only$ php artisan migrate --force  # creates the MongoDB indexes

   Serve api/public on the short-link domain, with the mongodb PHP extension installed. Any setup that runs Laravel works, such as nginx with PHP-FPM.

3. 03

   03Build and start the dashboard

   $ cd ../web$ pnpm install --frozen-lockfile$ pnpm build$ pnpm start  # serves on :3000

   Set API_URL in web/.env.local before you build. Next.js writes the proxy rules at build time. Use Laravel's private address if both apps share a server or network. Otherwise, use its public URL. Run pnpm start under a process manager and point the dashboard domain at it.

Before you go live

Real visitor IPs

Clicks need each visitor's real IP for country lookup and bot filtering. Tell Laravel which proxies and load balancers to trust, or every click records the proxy's address instead.

Email

Password resets and email verification send mail. Connect a mail provider before launch, because by default emails only go to the log.

IP retention

Rat keeps stored IPs until you remove them. To enforce a retention period, schedule the built-in purge command and follow the IP retention runbook in the repo.

No queue worker

Rat doesn't run background jobs, so there's no queue worker to set up in production.

API

Laravel 13, PHP 8.3+, MongoDB, Sanctum, Pest

Web

Next.js 16, React 19, TypeScript

Data and forms

TanStack Query v5, React Hook Form, Zod 4

UI

Tailwind CSS 4, shadcn/ui, shadcn charts, Magic UI, Hugeicons, Sonner

Tooling

Pint, ESLint, Prettier, Vitest, GitHub Actions, Laravel Boost

• GET/{slug}Redirect and record a click
• POST/api/v1/campaignsCreate a campaign with ten platform links
• POST/api/v1/campaigns/manualAdd a custom link to a campaign
• GET/api/v1/analytics/overviewWorkspace totals for 24h, 7d or 30d
• GET/api/v1/analytics/project/{id}/{metric}Heatmap, velocity, loyalty and ten more
• GET/api/v1/analytics/project/{id}/exportClicks as CSV or JSON
• GET/api/v1/analytics/campaign/{id}/deal-valueCompare effective CPC with paid ads
• POST/api/v1/sponsor-reportsCreate a share link
• GET/api/v1/public/reports/{token}Public report data without sign-in

Raw IPs stay internal

Rat uses raw IPs for country lookup and bot filtering. It excludes them from API responses and exports.

IP retention

A built-in command removes stored IPs from clicks older than the retention period you choose, and keeps the clicks. It only reports what it would remove until you confirm.

Cookie sessions

Sessions use HTTP-only Sanctum cookies with CSRF protection. Rat rate limits auth endpoints and public reports.

Privacy law

Check that your data collection complies with the privacy laws in your region before you go live.