Agreely Docs
FR EN

Verification and security

Tag-based verification ("snippet")

Verifying a site means confirming your tag is installed. You paste the tag into your <head>, you click Verify and scan (the site's Installation page), and the Agreely scanner opens the page and observes the data-agreely tag carrying your key.

There is no DNS record, no TXT file and no file to upload to verify a cookie banner. One exception: if your company already verified, for its Law 25 identity, a domain that covers this site, verification is inherited from that domain, with no further step.

Do not confuse the two. The DNS domain binding described in The protocol concerns the company DID and the signing of epoch roots, a function separate from the rest of the Agreely platform. It does not apply to cookie-banner installation, which is verified only by the tag.

Origin binding (enforced server-side)

The site key (agr_pub_...) is public: it lives in plain text in your page HTML. What protects it is not secrecy but server-side origin binding.

When the banner submits a decision to the POST /e/v1/consent endpoint, the server compares the request origin against the site's registered domain (or one of its subdomains) and its declared staging origins. If the origin does not match:

  • the request is refused with an HTTP 403 (origin_mismatch);
  • the refusal is fail-closed: no Access-Control-Allow-Origin header is returned, so a hostile page on another domain cannot even read the response;
  • the allowed-origin header is never returned as * on a consent submission: only the exact, recognized origin is echoed there. The answer to a preflight request (OPTIONS), which the banner does not send, echoes any well-formed origin; the refusal happens on the submission itself.

In other words, a consent submitted for the wrong domain is refused: copying your public key onto another site does not let anyone record consent in your name.

Client-side warning

In the browser, if the server responds 403 origin_mismatch, the banner client emits an explicit console warning:

[Agreely] Consentement refusé (403). Le domaine « example.com » n'est pas
autorisé pour cette clé Agreely (data-agreely). Vérifiez que la clé correspond
au domaine enregistré dans votre tableau de bord.

This is the signal to look for when you deploy on a domain other than the registered domain and its subdomains, for example a staging site hosted elsewhere (see the staging origins in Enforcement self-test).

The site key: public and capability-free

The agr_pub_... key is a public, capability-free identifier. It only allows two things, both bounded:

  • reading the public banner configuration (no personal information);
  • submitting a consent record, bounded by origin binding and rate limits.

It grants access to no account data, no dashboard and no privileged API. It is safe to include in your page HTML. To rotate it, click Rotate site key (the site's Installation page); the old key keeps working for 24 hours, then stops on its own (see Installation).

The banner's styles and markup live in a shadow root in open mode. This isolates the banner from your page's CSS: page CSS can neither break the banner's layout nor hide the free-tier credit. The open mode remains reachable by the page's JavaScript, however, so we do not claim absolute isolation, only isolation from CSS.

No inline styles, no eval, no origin other than cdn.agreely.ca: this is what allows a strict CSP without unsafe-inline (see CSP and CORS).

The honest boundaries

  • The banner is client-side JavaScript: it cannot read or delete httpOnly cookies, nor stop your server from sending a Set-Cookie. Handling your server-side cookies remains your responsibility (see Server side).
  • The zero-click scan is a point-in-time check, re-verified monthly: it documents a posture, it does not guarantee runtime enforcement at all times (see Enforcement self-test).
  • The on-chain anchor proves a decision was not modified since it was recorded, not the legal validity of the consent (see Verify a proof).

Agreely helps document and demonstrate your Law 25 compliance; your organization, as the responsible party, remains accountable for it.