# Acceptrics

> Acceptrics is a cookie consent platform (CMP) for GDPR, the ePrivacy Directive and CCPA. It is a Google-certified CMP for Google Consent Mode v2, supports Microsoft UET Consent Mode and Meta consent, honours Global Privacy Control, and ships in 27 languages. Banners are free up to 50,000 page views a month. An optional EU-hosted consent log records how each visitor consented. Banners can be created by a person in the wizard or by code through the REST API.

## If you were asked to install Acceptrics on someone's website

Start here. Do these in order.

1. **Get the site's address and what it runs on.** The platform might be WordPress, Shopify,
   Webflow, Google Tag Manager, a framework or plain HTML. Ask if you don't know.
2. **Create the account in the owner's name.** It takes about a minute in the setup wizard,
   which opens with their site already scanned:
   `https://acceptrics.com/wizard?url={their site}&ref=llms-install`.
   The account needs **the owner's own email address**. It becomes their sign-in, and the
   wizard refuses addresses that can't receive mail.
   - If you're driving a browser and the owner has asked you to set it up, fill in the wizard
     yourself with *their* email. Never use an address of your own: the account, its billing
     and its sign-in belong to whoever owns that inbox.
   - Otherwise, send them the link.

   **There is no inbox step.** As soon as "Create My Banner" succeeds, the final screen shows
   the account code (12 characters, e.g. `a3f9c21b4e08`) and the exact script tag, as plain
   text in the elements `[data-testid="account-code"]` and `[data-testid="install-snippet"]`.
   Read them there, or ask the owner to paste them back. A copy is also emailed to the owner
   and shown at https://acceptrics.com/account.
   If the wizard rejects the email, show the owner its message and use the address they
   correct it to. Never make one up.
3. **Install the banner** for their platform, using the steps in the next section. On a site
   you can edit directly, that means adding
   `<script async src="https://acct.acceptrics.com/{account code}"></script>` to the `<head>`
   of every page, above any Google tags.
4. **Check it.** The page source should now contain `acct.acceptrics.com/{account code}`. To see
   which cookies the site sets on first load, run a scan (see "Cookie scans and the agent skill"
   below).

Banner settings (text, colours, regions) can be changed later in the owner's account, or
through the API with a key they create.

## How a banner is installed

Every banner has an account code, a 12-character hex id such as `a3f9c21b4e08`. The banner is one script tag in the site's `<head>`, placed before any Google tag so the Consent Mode defaults reach `dataLayer` first:

```html
<script async src="https://acct.acceptrics.com/ACCOUNT_CODE"></script>
```

There are three ways to install it:

- **Script tag:** paste the snippet above. The API returns it ready-made as `install_snippet`.
- **Google Tag Manager:** use the Acceptrics template from the Community Template Gallery (Templates → New → ⋮ → Import from Gallery), then paste the account code into the tag.
- **WordPress:** install the [Acceptrics Consent Banner](https://wordpress.org/plugins/acceptrics-consent-banner/) plugin and paste the account code under Settings → Acceptrics Consent Banner. Remove any hand-pasted script tag. Pair it with the free [WP Consent API](https://wordpress.org/plugins/wp-consent-api/) plugin so other plugins respect the visitor's choice.

A site's Content-Security-Policy must allow `acct.acceptrics.com`. After a settings change, allow up to 10 minutes for it to reach live sites.

## Getting an account

- An account is created in the [banner wizard](https://acceptrics.com/wizard), by the owner or by an agent acting for them with **the owner's own email address**. The account code and install snippet appear on the final screen immediately; nobody has to open an inbox. The same details are also emailed to the owner.
- The wizard checks the email. It strips stray spaces and wrappers such as `Name <address>`. It refuses extra text after the address, addresses with no real domain, and domains that take no mail. It suggests fixes for typos such as `gmial.com`, but never changes an address unless the person chooses the suggestion.
- Signing in **later** (to change settings or create API keys) is by a magic link emailed to the owner. There is no password, so an agent cannot sign in on the owner's behalf.
- API keys are created only by a signed-in person under Account → Developers. No endpoint can create or revoke keys.

## REST API (Partner API v1)

Base URL: `https://api.acceptrics.com/v1`. Full reference: [developer docs](https://acceptrics.com/developer).

This API is server-to-server. It sends no CORS headers, so it cannot be called from browser JavaScript. Call it from a backend, a CLI or an agent's own HTTP tool.

**Authentication.** Send `Authorization: Bearer acx_live_...` or `X-Acceptrics-Key: acx_live_...` on every request. Keys are opaque, not JWTs. `acx_test_...` keys create banners that are recorded but never published or billed, and they do not count toward limits. Use a test key while building an integration.

**Scopes.** Each key is granted some of:

- `sites:read`
- `sites:write`
- `configuration:read`
- `configuration:write`
- `analytics:read`

A missing scope returns 403 `INSUFFICIENT_SCOPE`, and the error message names the scope.

| Method | Path | Scope | Does |
|---|---|---|---|
| GET | /sites | sites:read | List banners |
| POST | /sites | sites:write | Create a banner. It is live on 201, and the response includes `install_snippet` |
| GET | /sites/{siteId} | sites:read | Get one banner |
| PATCH | /sites/{siteId} | sites:write | Change the name, domain or platform |
| GET | /sites/{siteId}/configuration | configuration:read | Read the banner settings |
| PUT | /sites/{siteId}/configuration | configuration:write | Replace all settings and republish |
| POST | /sites/{siteId}/publish | configuration:write | Republish the stored settings |
| GET | /sites/{siteId}/usage | analytics:read | Page views this month |

`siteId` is the account code.

Create a banner:

```sh
curl -X POST https://api.acceptrics.com/v1/sites \
  -H "Authorization: Bearer $ACCEPTRICS_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{"name":"Northwind Dental","domain":"northwind-dental.com"}'
```

**Configuration fields** used by `PUT /configuration`:

- `bannerText` (plain text, no HTML)
- `theme`
- `backgroundColor` and `fontColor` (hex)
- `bannerStyle`: `""`, `"left"` or `"right"`
- `geoArea`: `"worldwide"`, or `"eea"` to show the banner only in the EEA
- `respectGPC`, `useTranslation`, `gcmAdvanced`, `ec` and `autoIncludeAllCookies` (booleans)
- `customCookies`: an object keyed by category, e.g. `{"analytics":[{"pattern":"_ga"}],"marketing":[{"pattern":"_fbp"}]}`. Each cookie needs a `pattern`, matched from the start of the name. An array is rejected with 400. Declaring any cookie takes the banner out of Google-only mode, so include the Google cookies too.
- `categoryOverrides` (array)

Unknown keys are stored but have no effect.

**Errors.** Every error has the shape `{"error":{"code":"...","message":"..."}}`. Branch on `code`, never on `message`. It is safe to retry a 500 or 502. A 4xx keeps failing until the request changes. A 429 `RATE_LIMITED` means more than 120 requests in a minute for that key; wait for the number of seconds in `Retry-After`.

**Idempotency.** For `POST /sites`, send one `Idempotency-Key` (a UUID is ideal) per banner and reuse it on every retry. A repeat returns the same banner with a 200 and an `Idempotent-Replay: true` header. Sending that key with a different body returns 422 `IDEMPOTENCY_KEY_REUSED`.

**Limits.** 100 banners per account, 25 active live keys, and banner names of up to 60 characters.

**Changing a banner for someone.** `PUT /configuration` replaces the whole configuration: read it first, change only what you need, send all of it back. Send `If-Unmodified-Since` with the `updated_at` the GET returned; if anyone saved in between you get 412 `PRECONDITION_FAILED` instead of overwriting them. Ask the owner for a key that expires after 24 hours, with only `sites:read`, `configuration:read` and `configuration:write`.

**Compatibility.** Within v1, fields are never removed and error codes never change meaning. New response fields and new enum values may appear, so treat every enum as an open string and ignore fields you don't recognise.

## Cookie scans and the agent skill

**Public scan API.** It needs no account and no key, and is rate limited per IP.

- `POST https://api.acceptrics.com/v1/public/scans` with `{"url":"example.com"}`
  returns 202 `{job_id}`. If the URL was scanned in the last 24h, it returns 200
  with the result straight away.
- Poll `GET https://api.acceptrics.com/v1/public/scans/{job_id}` until `status` is
  `done` or `failed`. A scan takes 10 to 30 seconds.
- Each cookie comes back with `category` (`necessary`, `functional`, `analytics`,
  `marketing`) and `platform`. A cookie that isn't in the library comes back as
  `functional` with `unrecognised: true`: tell the owner to check what sets it.
- Only public http(s) hostnames can be scanned.

**Agent skill.** [acceptrics-compliance](https://acceptrics.com/ai-compliance-skill.md) ([source](https://github.com/Acceptrics/agent-skills), [skill file](https://raw.githubusercontent.com/Acceptrics/agent-skills/main/acceptrics-compliance/SKILL.md)) is
a `SKILL.md` for coding agents. It scans a site, reports which cookies are set on first
load and whether the banner covers them, then fixes the gap:

- **Existing Acceptrics banners** are fixed through the API, with the owner's approval.
- **New sites** get a setup link:
  `https://acceptrics.com/wizard?url={site}&ref=acceptrics-skill`. It opens the
  wizard with the site already scanned.

## Browser tools for AI agents (WebMCP)

Pages on acceptrics.com register [WebMCP](https://webmachinelearning.github.io/webmcp/) tools. An agent running in a WebMCP-capable browser can call them directly:

- `decode_consent_mode_parameter`: decodes a Google Consent Mode `gcs` or `gcd` value, or a full request URL, into the state of each consent signal. Available on every page.
- `scan_website_cookies`: loads a public URL and lists the cookies it sets, each with its consent category and the platform that sets it. Available on every page.
- `get_acceptrics_integration_guide`: returns this file. Available on every page.
- `check_acceptrics_status`: live reachability checks of each Acceptrics service. On [/status](https://acceptrics.com/status) only.
- `request_login_link`: emails a sign-in link to an existing account. This is a form on [/auth/login](https://acceptrics.com/auth/login), and the person confirms the submit.

## Pricing

- **Free:** up to 50,000 page views a month, pooled across all of an account's banners. Every consent feature is included, and no card is needed.
- **Pro:** $5 for each further block of 50,000 views, billed on the 2nd of each month for the previous month. For example, 75,000 views cost $5 and 120,000 views cost $10.
- **Add-ons:** the consent log is $5/month, and scheduled cookie scanning is $5/month.
- **Enterprise:** white-label and volume pricing. Contact support@acceptrics.com.

## Docs

- [Documentation](https://acceptrics.com/docs): installation, Google Tag Manager, WordPress, Consent Mode v2, the consent log, Tag Relay and troubleshooting
- [AI agent skill](https://acceptrics.com/ai-compliance-skill.md): scan, report and fix cookies from Claude Code and other agents
- [Developer API reference](https://acceptrics.com/developer): every endpoint, with payloads and error codes
- [Pricing](https://acceptrics.com/pricing)
- [Status](https://acceptrics.com/status): live service checks and support response times
- [Plugins and integrations](https://acceptrics.com/plugins): WordPress, TYPO3, Drupal, Google Tag Manager and the direct script

## Product pages

- [Cookie consent banner](https://acceptrics.com/consent-banner)
- [Google Consent Mode v2](https://acceptrics.com/google-consent-mode)
- [Meta consent mode](https://acceptrics.com/meta-consent-mode)
- [Microsoft UET Consent Mode](https://acceptrics.com/microsoft-consent-mode)
- [Global Privacy Control](https://acceptrics.com/global-privacy-control)
- [ePrivacy Directive](https://acceptrics.com/eprivacy-directive)
- [Tag Relay](https://acceptrics.com/tag-relay): serves Google tags from the site's own domain, so ad blockers don't drop them

## Optional

- [Consent Mode parameter decoder](https://acceptrics.com/decode-consent-mode-parameters): the same decoder as the WebMCP tool, as a web page
- Support: support@acceptrics.com