Cookie script
Install the script, its options, events and JavaScript API.
The script shows the cookie banner and widget, holds trackers until the visitor allows them, renders the consent block, and records decisions with proof.
<script src="https://v1.pactbase.in/sdk/v1/pactbase.js" data-org="ORG_ID" data-site="SITE_KEY"></script>Put it first in <head>, without async or defer, so it sees every tag after it. Copy your own from Settings, then Domains. See Install the script.
Versions
| URL | What it is |
|---|---|
/sdk/v1/pactbase.js | The install URL. Always the latest v1 release |
/sdk/v1/pactbase-VERSION.js | One release, for example pactbase-1.8.4.js. Never changed once published, for sites that pin a version or use subresource integrity |
/sdk/v1/pactbase.debug.js | Unminified, with a source map |
Install attributes
| Attribute | Default | Purpose |
|---|---|---|
data-org | required | Your organisation id |
data-site | recommended | The website's own key (Settings, Domains). Consent and banner views are recorded for that website, and the API refuses the key on any other website |
data-banner | on | off renders consent blocks only: no banner, no floating button, nothing held |
data-storage | local | cookie also stores the decision in a first-party cookie, so subdomains and your server can read it |
data-cookie-domain | none | Cookie domain for sharing across subdomains, for example .example.com |
data-lang | browser language | Forces the widget language |
data-reload-on-withdraw | off | Reloads the page when consent is withdrawn, for tags that already ran |
data-blocking | auto | strict also holds unknown outside hosts until your tracker list is known. manual turns off automatic holding, so only marked-up tags are held |
data-unknown-cookies | block | A cookie your own code writes that nothing categorises waits for "accept all". allow writes it at once |
data-google-consent-mode | off | basic or advanced. See Google Consent Mode v2 |
JavaScript API
pactbase.getConsent('analytics') // a category, purpose id or purpose name
pactbase.getState() // { purposes, categories, confirmed, updatedAt }
pactbase.on('consent', (state) => {}) // also 'ready', 'show', 'hide'; late subscribers get the last event
pactbase.show() // open the preferences panel
pactbase.acceptAll(); pactbase.rejectAll()
pactbase.setConsent({ 'Ads pixel': true, analytics: false })
pactbase.reset() // forget the decision and show the banner again
pactbase.identify({ email }) // link the anonymous id to an emailEvery event is also dispatched on window as pactbase:EVENT. Calls made before the script loads are queued and run when it does:
window.pactbase = window.pactbase || [];
pactbase.push(['on', 'consent', function (state) { /* ... */ }]);The script also pushes Google Tag Manager events: pactbase_consent and pactbase-CATEGORY-accepted.
Checking consent on your server
By default the choice lives in the browser's local storage, which a server cannot read. Add data-storage="cookie" and the choice is also a first-party cookie, pactbase_consent_ORG_ID, holding URL-encoded JSON:
{ "v": 2, "categories": ["strictly_necessary", "analytics"], "purposes": { "PURPOSE_ID": true }, "updatedAt": 1759530000000 }Set a non-essential cookie only when its category is in categories. No cookie, or a missing category, means no consent.
Accessibility and languages
The banner has dialog roles, keyboard support (Escape closes it), focus handling and right-to-left layout, and its text can be shown in the 22 Eighth Schedule languages.