Configuration
All configuration is managed through the Admin UI. Sign in, then use the tabs to edit each section. Click Save Changes to apply — the Redis cache is invalidated immediately and the CDN will serve the updated config within 5 minutes.
Banner text
The Banner Text tab controls all the copy shown in the consent banner.
| Field | Shown where | Default |
|---|---|---|
| Headline | Bold title at the top of the banner | We use cookies |
| Description | Subtitle below the headline | Help us improve your experience. |
| Accept all label | Primary action button | Accept all |
| Reject all label | Secondary action button | Reject all |
| Save label | Button in the preferences panel | Save preferences |
| Manage label | Link that opens the preferences panel | Manage preferences |
Privacy policy link
You can add a link to your privacy or cookie policy that appears in the banner alongside the "Manage preferences" link. Set the Privacy Policy URL field in the Banner Text tab to a full URL (e.g. https://example.com/privacy).
Styling
The Styling tab controls the visual appearance of the banner.
Primary colour
Sets the accent colour used for buttons, toggle switches, and links. Use the colour picker or type a hex value. The SDK applies this as a CSS custom property (--cc-primary) within a Shadow DOM, so it won't leak into your page's styles.
Font family
By default this is inherit, which picks up the font from your page's body. You can override it with any CSS font stack (e.g. 'Inter', sans-serif).
Position
| Option | Appearance |
|---|---|
bottom-bar | Full-width bar fixed to the bottom of the viewport. Default. |
bottom-left | Compact card anchored to the bottom-left corner. |
center-modal | Centred modal with a semi-transparent overlay. Most prominent. |
Geo rules
Geo rules let you apply different consent modes based on the user's country. The SDK resolves the user's region from the CF-IPCountry header set by Cloudflare — no client-side geolocation is used.
Modes
| Mode | Behaviour | When to use |
|---|---|---|
opt-in |
Banner is shown. Nothing is granted until the user actively accepts. | EU, EEA, UK (required by GDPR/UK GDPR). |
opt-out + showBanner: false |
All categories granted silently. No banner shown. | US states without strict privacy laws. |
opt-out + showBanner: true |
Banner shown but all categories pre-granted. User can opt out. | Regions where opt-out is legally sufficient but transparency is desired. |
Region codes
Use EU to match all EU/EEA countries, GB for the UK, or any ISO 3166-1 alpha-2 country code (e.g. US, CA). Use * as a catch-all fallback rule — it must be listed last.
EU → opt-in, showBanner: true and * → opt-out, showBanner: false. EU users see the banner; everyone else gets silently opted in.
Categories
Categories define the consent groups you ask users about. Each category maps to a toggle in the banner's preferences panel.
| Field | Description |
|---|---|
| Slug | Machine-readable ID used in data-cc-category attributes and the SDK's decisions object. Must be unique (e.g. analytics, marketing). |
| Name | Human-readable label shown in the banner (e.g. "Analytics"). |
| Description | Short explanation shown below the name in the preferences panel. |
| Required | If true, the toggle is disabled and always on. Use for essential/functional cookies only. GDPR prohibits marking non-essential categories as required. |
| Default value | Must be false for non-required categories (GDPR Art. 4(11) — no pre-ticked boxes). |
Script rules
Script rules tell the SDK which third-party scripts belong to which consent category. A script matching a rule is held until the user grants that category.
| Match type | Matches when… | Example value |
|---|---|---|
domain | The script's hostname equals the value or is a subdomain of it | google-analytics.com |
srcContains | The script's full src URL contains the string | gtm.js |
srcRegex | The script's src URL matches the regular expression | facebook\.net\/.*\/fbevents |
Script scanner
The script scanner visits a URL on your site and detects all third-party <script> tags. It cross-references them against your existing rules and tells you which scripts are already covered, which are uncovered (need a new rule), and which are unknown.
To use it, go to the Script Scanner tab in the Admin UI and enter a URL on your site. The scanner fetches the page server-side, so it won't be blocked by browser extensions.
Saving & caching
When you click Save Changes:
- The config is updated in Postgres and the version number is incremented.
- The Redis cache entry for your customer is immediately deleted.
- The next request to
/config/v1/:customerId.jsonwill fetch from Postgres and re-warm the cache. - The CDN (if configured) is purged via the Cloudflare API.
Visitors who already consented under a previous config version will see the banner again — their stored decisions are tied to the version number. This ensures they can re-consent after you add a new category.