Agreely
FR EN

Verification and security

Tag-based verification ("snippet")

Verifying a site means confirming your tag is installed. You paste the tag into your <head>, you click Verify the installation, and the Agreely scanner opens the page and observes the data-agreely tag carrying your key.

There is no DNS record, no TXT file and no file to upload to verify a cookie banner. Tag-based verification is the only step.

Do not confuse the two. The DNS domain binding described in The protocol concerns the company DID and the signing of epoch roots, a function separate from the rest of the Agreely platform. It does not apply to cookie-banner installation, which is verified only by the tag.

Origin binding (enforced server-side)

The site key (agr_pub_...) is public: it lives in plain text in your page HTML. What protects it is not secrecy but server-side origin binding.

When the banner submits a decision to the POST /e/v1/consent endpoint, the server compares the request origin against the site's registered domain (and its declared extra origins). If the origin does not match:

  • the request is refused with an HTTP 403 (origin_mismatch);
  • the refusal is fail-closed: no Access-Control-Allow-Origin header is returned, so a hostile page on another domain cannot even read the response;
  • the allowed-origin header is never returned as *: only the exact, recognized origin is echoed.

In other words, a consent submitted for the wrong domain is refused: copying your public key onto another site does not let anyone record consent in your name.

Client-side warning

In the browser, if the server responds 403 origin_mismatch, the banner client emits an explicit console warning:

[Agreely] Consentement refusé (403). Le domaine « example.com » n'est pas
autorisé pour cette clé Agreely (data-agreely). Vérifiez que la clé correspond
au domaine enregistré dans votre tableau de bord.

This is the signal to look for when you deploy on a new domain or a subdomain you have not yet declared (see the extra origins in Enforcement self-test).

The site key: public and capability-free

The agr_pub_... key is a public, capability-free identifier. It only allows two things, both bounded:

  • reading the public banner configuration (no personal information);
  • submitting a consent record, bounded by origin binding and rate limits.

It grants access to no account data, no dashboard and no privileged API. It is safe to include in your page HTML. To rotate it, generate a new one in the website settings; a 24-hour grace period lets both keys work in parallel, then you revoke the old one (see Installation).

The banner's styles and markup live in a shadow root in open mode. This isolates the banner from your page's CSS: page CSS can neither break the banner's layout nor hide the free-tier credit. The open mode remains reachable by the page's JavaScript, however, so we do not claim absolute isolation, only isolation from CSS.

No inline styles, no eval, no origin other than cdn.agreely.ca: this is what allows a strict CSP without unsafe-inline (see CSP and CORS).

The honest boundaries

  • The banner is client-side JavaScript: it cannot read or delete httpOnly cookies, nor stop your server from sending a Set-Cookie. Handling your server-side cookies remains your responsibility (see Server side).
  • The zero-click scan is a point-in-time check, re-verified monthly: it documents a posture, it does not guarantee runtime enforcement at all times (see Enforcement self-test).
  • The on-chain anchor proves a decision was not modified since it was recorded, not the legal validity of the consent (see Verify a proof).

Agreely helps document and demonstrate your Law 25 compliance; your organization, as the responsible party, remains accountable for it.