Choose a provider

Every native provider needs one publishable id — the same id you'd paste into that vendor's own install snippet. It is not a secret; it's the account/site identifier the vendor's script reads. You set it in the preset object.

The id each vendor needs

The pinned host is a hard boundary: a native provider can load consent script from only that origin. The reader Content-Security-Policy is built from it, so a misconfigured or hijacked id can never pull script from anywhere else.

Example

Point the whole organization at CookieMunch:

{
  "provider": "cookiemunch",
  "preset": { "cbid": "your-site-id" }
}

Providers that need no vendor account

hosted — the Forumulate banner

We render a structured consent banner in your space's theme. No third-party script loads. You control the categories offered and the copy — as fields, never raw HTML:

{
  "provider": "hosted",
  "hosted": {
    "categories": ["necessary", "functional", "analytics", "marketing"],
    "copy": { "title": "We use cookies", "body": "Short explanation…" },
    "links": { "privacy": "https://example.com/privacy", "cookies": "https://example.com/cookies" },
    "theme": "space"
  }
}

Categories are drawn from necessary, functional, analytics, marketing, and personalization.

managed — in-house managed CMP

managed renders a CookieMunch loader for a site we provision under our own key — a white-label option when you want a real CMP but don't want to run an account. It loads from the same pinned cdn.cookiemunch.net host as the bring-your-own CookieMunch provider. Ask us to enable it for your organization.

none

Essential cookies only. No banner, no third-party script. This is the safe default posture.

Overriding for one space

Any space can break from the org default. In the space's Privacy & consent panel choose Override and set a full provider config there; choose Inherit to fall back to the organization default. See the mode field in the API reference.

Not listed here?

Bring any other CMP with the custom provider — either by pointing us at its loader on a domain you've verified, or by wiring its preferences API. See Custom CMP.