Skip to content
ikuad
العربيةSign up
Menu

Docs

ikuad's public contracts, documented here as they are in the code. The outside-websites snippet is being finished — its contract is documented now so you can build against it.

The snippet — for sites outside matgrk

One script, first in <head>, from cdn.ikuad.com: it shows the banner and blocks what was not consented to before it runs. The whole configuration arrives with the script, so there is no extra request:

<script src="https://cdn.ikuad.com/s/SITE_KEY.js"></script>

<!-- any script to hold back until consent: -->
<script type="text/plain" data-ikuad="analytics">
  … your analytics here …
</script>
  • Signals start denied before anything else on the page, and update on every choice.
  • Scripts tagged data-ikuad="<category>", and later-injected scripts and iframes for categorised hosts, stay blocked until that category is consented.
  • The snippet lives under a hard budget: 14 KB gzipped including your site's configuration — hold us to it.

JavaScript API

The snippet exposes window.ikuad to your page:

ikuad.getConsent()
// { preferences: true, analytics: false, advertising: false,
//   necessary: true, version: 7, gpc: false }

ikuad.on("change", (choices) => { … })

ikuad.open()   // opens the choice panel — same as the reopen link
  • A choice applies from the next event on the same page; no reload, no refresh to wait for.
  • getConsent always returns all four categories plus the banner version the visitor answered.

Consent Mode v2

The mapping is fixed for every category (and it is what matgrk's surfaces push too):

strictly necessary → security_storage
preferences         → functionality_storage, personalization_storage
analytics            → analytics_storage
advertising         → ad_storage, ad_user_data, ad_personalization
  • On every change: gtag("consent", "update", …) and a dataLayer event if you prefer listening for one.

Global Privacy Control

The browser's GPC signal is read on load: advertising is refused, the record notes the source as "GPC", and the visitor can still open settings and explicitly accept.

navigator.globalPrivacyControl === true
// → advertising refused, source recorded as "GPC"
  • We do not treat GPC as a blanket refusal — preferences and analytics remain the visitor's open question, as the regime intends.

The published configuration and the collector

The published configuration is public JSON cached at Cloudflare and purged on publish; the collector receives records straight from the visitor's browser with no cookies, from your site's domains only (CORS), with rate limits and client-ref de-duplication. Full details with examples live in contracts/consent-public-api.md in ikuad's repository.

GET  https://cdn.ikuad.com/v1/sites/{site_key}/published.json
POST https://consent.ikuad.com/v1/records
POST https://consent.ikuad.com/v1/views