Agreely Docs
FR EN

Installation

The single tag

Paste this tag first in your <head>, before any tag manager or analytics script:

<script
  src="https://cdn.agreely.ca/e/v1/loader.js"
  data-agreely="agr_pub_YOUR_KEY"></script>

Place this tag first, before any other script, and without the async attribute: the loader must run before your other tags. It is light (around 3 KB compressed) and executes immediately. On execution it synchronously installs the Consent Mode v2 signal in default-deny mode and the guard that defers known tracker hosts until consent is granted; it then downloads the banner module asynchronously, without blocking rendering. This order (loader first, synchronously) is what lets the guard hold back trackers from known hosts and install Google's default deny before any other tag. A tracker served from a host outside that list, and not converted to type="text/plain", is not held back; what the guard cannot reach (document.write, among others) is described with script blocking.

Subresource integrity (SRI)

The loader embeds the sha384 hash of the banner module by default; the injected script carries integrity and crossorigin="anonymous" automatically. No extra attribute is needed on the base tag.

For pinned versions (URL of the form /e/vX.Y.Z/loader.js, for example /e/v1.5.3/loader.js), the URL is immutable and the SRI is fixed: useful if you want to control the exact deployed version. A pinned version, however, receives no later fix; the /e/v1/ tag always follows the current version, which window.agreelyCookies.version shows in the console.

<script
  src="https://cdn.agreely.ca/e/v1.5.3/loader.js"
  data-agreely="agr_pub_YOUR_KEY"></script>

CSP nonce

If your script-src is nonce-based, pass the nonce via the data-nonce attribute and the loader forwards it to the injected module script:

<script
  src="https://cdn.agreely.ca/e/v1/loader.js"
  data-agreely="agr_pub_YOUR_KEY"
  data-nonce="abc123"></script>

Getting your site key

  1. Sign in to the banner app, cookies.agreely.ca.
  2. Click Add a website and enter your domain. It takes a free place: if you have none, buy one first in Billing (see pricing).
  3. Under your site > Installation, copy the tag, which already carries your site key (agr_pub_...), and paste it into your <head>.
  4. On the same page, click Verify and scan. The Agreely scanner loads your page, confirms the loader tag with your key is present, marks the site as verified and inventories the cookies it finds. The scan runs in the background.

If your company already verified, for its Law 25 identity, a domain that covers this site, verification is inherited automatically: the Verify by inheritance button confirms it without waiting for a scan.

The banner only shows once the site is verified and a first version is published from the site's Publishing page.

Tag-based verification, not DNS. Verification simply confirms that the data-agreely tag is present on the page: you install the tag, you click Verify and scan, and the Agreely scanner observes the tag. There is no DNS record or TXT file to publish for the banner. See also Verification and security.

The site key is a public, capability-free identifier. It only allows reading the public configuration and submitting a rate-limited, domain-checked consent record. It is safe to include in your page HTML.

Key rotation

To rotate a key, click Rotate site key on the site's Installation page. The new key is issued at once; the old one keeps working for 24 hours while you roll out the new tag, then stops on its own. There is no separate revocation step.

Reopening the banner

After their decision, the person finds by default a floating "Manage cookies" button that reopens their preferences. You can also add your own link or button, with the data-agreely-preferences attribute (the older data-agreely-open attribute still works):

<a href="#" data-agreely-preferences>Manage my cookies</a>

This trigger lets the person review or withdraw their choice at any time; keep it visible and keyboard-reachable on every page. The floating button can be turned off in the banner designer (see The banner designer): only do so if your page already offers such a trigger. If none is detected, the banner shows a fallback button. The Act requires informing the person of their right to withdraw consent (P-39.1 s. 8, first paragraph, subparagraph 4) or, for a public body, of the consequences of a withdrawal (A-2.1 s. 65, first paragraph, subparagraph 5); this permanent link is how Agreely recommends giving that effect. You can also call it programmatically:

window.agreelyCookies.open();      // open preferences
window.agreelyCookies.acceptAll(); // accept all programmatically
window.agreelyCookies.refuseAll(); // refuse all programmatically
window.agreelyCookies.withdraw();  // withdraw active consent
window.Agreely.openPreferences();  // open preferences (other namespace)

Accessibility note. The preferences layer (role="dialog", aria-modal="true") manages focus traps, Esc key handling, and focus restoration. Layer 1 (the main banner) does not block scrolling or navigation so that consent remains free.