Cookies & consent
Forumulate lets you run your own cookie-consent / CMP (Consent Management Platform) on your reader surfaces — the docs, blog, forum, and every other public space on your site. This is bring-your-own-CMP (BYOCMP): you keep the vendor and the account you already have, and Forumulate loads it for you on your published pages, safely.
If you have no CMP at all, you can use our hosted banner or a managed in-house option instead — no third-party account required.
How it fits together
Consent is configured at two levels:
Organization default — one setting that applies to every space on your site.
Per-space override — any space can inherit the org default, or override it wholesale (for example, a marketing blog that needs marketing cookies while your API reference stays essential-only).
A space is set to inherit until you explicitly override it, so you configure once and every surface follows.
Consent is dark by default. Until you pick a provider, Forumulate ships an essential-only posture and emits its Content-Security-Policy in Report-Only mode — nothing your readers see changes, and no third-party script runs, until you turn a provider on.
The providers at a glance
Provider | What it is |
|---|---|
| (Spaces only) use the organization default. |
| No banner — essential cookies only. |
| Forumulate renders a structured banner. No vendor account. |
| An in-house managed CMP we provision for you. |
| CookieMunch, on your own account. |
| Cookiebot. |
| OneTrust. |
| Osano. |
| Termly. |
| Any other CMP — by verified loader URL or by adapter API. |
Each native provider loads from one pinned CDN host and nothing else — that origin is the only third-party script your reader CSP will ever allow for consent. See Choose a provider for the exact host and the id each one needs.
Where to set it
Open your organization → Privacy & consent, pick a provider, and paste the publishable id your vendor gives you. A space-level override lives in that space's settings under the same panel.
Prefer to automate it? Everything here is available over the API — see the Consent API reference.
Next
Choose a provider — the id each vendor needs and where to find it.
Custom CMP — bring a vendor we don't list natively.
Consent & DSAR webhook — receive signed consent / data-subject events.
Consent API reference — read, write, and rotate over the API.