Developers

Build on ConsentCook

One script tag puts the banner on a site. Everything it then serves — the published configuration, the cookie list, the signed record of each choice — is readable over plain HTTP, and the signatures can be checked without asking us for anything.

Install the banner

Paste this into the <head> of your site, before any tracking scripts. Your site key is on the site’s page in the dashboard.

<script src="https://consentcook.com/loader.js"
        data-site="YOUR_SITE_KEY"></script>

On WordPress and Shopify you do not need the snippet at all — the plugin and the app put it in place for you and keep the key in step.

Read a site’s published configuration

The banner fetches exactly one thing to decide what to show and what to hold back. It is public, it is signed, and you can read it yourself:

GET https://consentcook.com/config/<site key>.json

The response carries an x-cc-signature header over the exact bytes of the body. It is deliberately not cached for any length of time, so a change you publish is the change your visitors get on their next page view.

Check a consent receipt without trusting us

Every choice a visitor makes is recorded and signed with ECDSA P-256 at the moment it arrives. The public keys are published, so a receipt can be verified by anyone, offline, including against us:

GET https://consentcook.com/v1/public/receipt-signing-keys

That is the point of signing them. A consent record you can only check by asking the company that wrote it is not evidence of much.

Connect an AI assistant

@consentcook/mcp is on npm. It speaks the Model Context Protocol, so an assistant that supports MCP can read your sites, scan results and consent records directly.

npx @consentcook/mcp

It authenticates with an API key. Keys are scoped, default to denying everything they are not granted, and are created in Developers in the dashboard — the one page named here that needs an account, because it shows your keys.

Questions and terms

For anything not covered here, get in touch. The security page sets out how the service is run, and the subprocessor list names everyone who touches the data.