@c15t/core: Headless JavaScript cookie consent engine

The headless JavaScript cookie consent engine behind every c15t adapter. It resolves consent policies for GDPR and other privacy laws, stores choices, and holds back configured scripts, iframes, and network requests that the visitor's policy and choices do not allow. Use it to build your own consent UI or to connect a framework that has no c15t adapter.

c15t is used by 2,100+ sites, including expo.dev, zed.dev, unkey.dev, mintlify.com, and sazabi.com.

Key Features

• Bring your own UI: render from a consent snapshot, and c15t keeps state, storage, and policy resolution
• Control configured scripts, iframes, and network requests with category permissions from the resolved policy
• Policies decide who sees a banner: opt-in for visitors in the EU, opt-out for some US states, or rules that you write
• Google Consent Mode v2, IAB TCF 2.4, and Global Privacy Control support
• Creating a runtime has no side effects, so the module is safe to import on the server
• Vendor loaders for Google Tag Manager, Meta Pixel, PostHog, and more through @c15t/integrations

Prerequisites

• Node.js 20.19 or later
• An Inth project (free sign-up). For development and tests, local mode needs no backend

Installation

pnpm add @c15t/core

The c15t package ships the same engine at c15t and c15t/runtime, plus every framework adapter.

Usage

1. Create one runtime for the page with createConsentRuntime and a mode such as hosted()
2. Call runtime.start() in the browser
3. Render your banner from runtime.kernel.getSnapshot() and update it from runtime.kernel.subscribe()
4. Record choices with runtime.kernel.commands.save('all'), save('none'), or an object such as { measurement: true }
5. For the full walkthrough, see the headless runtime guide

// src/consent-runtime.ts
import { hosted } from '@c15t/core'
import { createConsentRuntime } from '@c15t/core/runtime'

export const runtime = createConsentRuntime({
  mode: hosted({ backendURL: 'https://your-project.inth.app' }),
})

Run c15t on Inth

c15t needs a backend to serve policies and keep consent records. Inth runs it for you. It stores every choice with its region and policy version, audits your live site and pull requests for privacy risk, and on Pro and above keeps each region's consent rules current with managed policy packs. You don't run the consent database, geo lookups, uptime, or upgrades.

Sign-up is free. Run npx @inth/cli c15t to create a project and set up c15t, or create one by hand and copy its backend URL.

For development and tests, local mode keeps choices in the browser and keeps no consent records. Don't ship it to production. Its factory is local(). The old name, offline(), still works and goes away in v4.

Documentation

See the documentation for guides, API reference, and examples.

Related Packages

• c15t: this engine plus the React, Next.js, Vue, Nuxt, Astro, and TanStack Start adapters in one install
• @c15t/browser: a stock banner and preference dialog for plain JavaScript and script-tag sites
• @c15t/integrations: consent-aware analytics, tag manager, pixel, and widget loaders

Docs for AI Agents

This package ships its documentation as Markdown, matched to the installed version. After you install it, point your coding agent at node_modules/@c15t/core/AGENTS.md. It indexes every guide in node_modules/@c15t/core/docs/.

On the web, every page of the c15t docs has a Markdown version, and llms.txt lists them all. Install the c15t agent skills with npx skills add c15t/skills.

Support

• Join our Discord community
• Open an issue on our GitHub repository
• Visit inth.com and use the chat widget
• Contact our support team via email [email protected]

Contributing

• Read the contribution guidelines before you open a pull request
• Follow the code of conduct

Security

Do not open a public issue for a security vulnerability. Report it privately through GitHub's vulnerability reporting. We examine every valid report.

• Do not share the vulnerability in public forums, issues, or pull requests
• Give the steps to reproduce it and the versions it affects
• Give us time to release a fix before you disclose it

License

Apache License 2.0

Built by Inth