DOCUMENTATION

Install with one line, customize without limits

Get started with a single line of code. HTML, WordPress, Shopify, Next.js or GTM: a step-by-step guide for every platform.

QUICK START

A Working Banner in 3 Steps

Follow the steps below.

Create an Account

14-day free trial. No credit card required; you sign up with your email address.

Add a Domain

Enter your domain URL on the Admin Panel > Domains screen. An API key and secret key are generated automatically.

Paste the Code

Add the single-line installation code as the first line inside your site's <head> tag. The banner and widget load automatically.

EMBED CODE

One Line, Two Products

Add the code below right after the opening <head> tag of your site, before every other script. Get the data-cerez-key value from the Admin Panel > Installation page.

<!-- cerez.io Cookie Consent + Accessibility -->
<script src="https://cerez.io/sdk/loader.js"
        data-cerez-key="YOUR_API_KEY"></script>
Important Do not add async or defer. The small loader has to run before every other script: it writes the Google Consent Mode default first and holds back known trackers added with JavaScript until consent is given. It loads the banner and widget code async by itself. The configuration is cached server-side for 5 minutes; the SDK reflects your changes on the next load.
NPM PACKAGE

Install with npm

The @cerez-io/sdk package is for developers who build apps with React, Next.js or Vue and want to manage the setup in their own code. The package runs the same code as the installation tag: it writes the Consent Mode default, holds known trackers added with JavaScript until consent, and loads the banner with your panel settings.

Important The recommended way to block trackers while the page loads is the installation tag in <head>; the npm package does not replace it. The package runs after your app code has loaded and cannot stop trackers that sit in the HTML or run before it. Mark those tags with type="text/plain" and data-cb-category. Do not use the package together with the installation tag: only one of them should be on the page.

1. Install the package

npm install @cerez-io/sdk

2. Initialize at your app's entry point

Call init before any other tracker code (Google Analytics, Meta Pixel, GTM). Replace YOUR_SITE_KEY with the site key from the Installation page in the panel.

import { init, on, hasConsent } from '@cerez-io/sdk';

init({ key: 'YOUR_SITE_KEY' });

on('consent', () => {
  if (hasConsent('analytics')) {
    startAnalytics();
  }
});

3. Navigation in a single-page app

Call page() after client-side navigation; the first load is counted automatically. The example is for Vue Router.

import { page } from '@cerez-io/sdk';

router.afterEach(() => page());

Next.js

init must run in the browser; called on the server it does nothing. Add the component once to the root layout.

'use client';

import { useEffect } from 'react';
import { init } from '@cerez-io/sdk';

export default function CerezIo() {
  useEffect(() => {
    init({ key: 'YOUR_SITE_KEY' });
  }, []);

  return null;
}

Other functions: getConsent(), hasConsent(category), showBanner(), on('consent', fn). Options (host, lang, autoBlock, nonce, userId) are described on the package's npm page.

PLATFORMS

Ready-Made Guides for 6 Platforms

A detailed step-by-step installation guide is available for every platform.

HTML / Static Site

Add it as the first line inside the <head> tag. Setup takes 30 seconds.

<head>
  <script src="https://cerez.io/sdk/loader.js"
          data-cerez-key="YOUR_KEY"></script>
  <!-- mevcut etiketler -->
</head>

WordPress

Download the WP Plugin ZIP, install the plugin, enter the API key.

# Seçenek A: Plugin ile (önerilen)
Admin Panel > Eklentiler > Yeni Ekle
ZIP yükle > Etkinleştir > API Key gir

# Seçenek B: Manuel (functions.php)
add_action('wp_head', function() {
  echo '<script src="https://cerez.io/sdk/loader.js"
  data-cerez-key="YOUR_KEY"></script>';
}, PHP_INT_MIN);

Shopify

Add it inside theme.liquid or use a Custom Code Injector.

<!-- theme.liquid içinde, <head> etiketinin hemen altına -->
<script
  src="https://cerez.io/sdk/loader.js"
  data-cerez-key="YOUR_KEY"></script>

Next.js / React

Use a plain <script> as the first element inside <head> in the root layout; the next/script strategies load the script late.

// app/layout.tsx
export default function RootLayout({ children }) {
  return (
    <html>
      <head>
        <script
          src="https://cerez.io/sdk/loader.js"
          data-cerez-key="YOUR_KEY"
        />
      </head>
      <body>{children}</body>
    </html>
  )
}

Google Tag Manager

Create a Custom HTML tag and publish it with the Consent Initialization - All Pages trigger. Code installed through GTM runs after GTM has loaded; it cannot stop the GTM container or tags written into the page before consent. If you can, add the code directly to the head tag.

<!-- GTM > Tags > New > Custom HTML -->
<script
  src="https://cerez.io/sdk/loader.js"
  data-cerez-key="YOUR_KEY"></script>

<!-- Trigger: Consent Initialization - All Pages -->

Webflow

Paste it at the very top of Site Settings > Custom Code > Head Code.

<!-- Site Settings > Custom Code > Head Code -->
<script
  src="https://cerez.io/sdk/loader.js"
  data-cerez-key="YOUR_KEY"></script>
JAVASCRIPT API

Programmatic Control: 5 Core Methods

You can open the banner from your own UI, check consent and listen to events. All methods live under the window.cerez.io namespace.

CerezBanner.show()

Shows the banner manually. It can be called from custom triggers such as a "Manage My Cookie Preferences" button.

// Footer'daki "Çerez Tercihlerim" linkine event listener
document.querySelector('#cookie-prefs').addEventListener('click', () => {
    CerezBanner.show();
});
CerezBanner.getConsent()

Returns the user's current consent state. If no decision has been made yet, it returns null.

const consent = CerezBanner.getConsent();
// Örnek dönüş:
// { necessary: true, analytics: true, marketing: false, functional: true, timestamp: 1717000000 }

if (consent?.analytics) {
    // Google Analytics'i yükle
}
CerezBanner.on(event, callback)

Listen to consent changes. Supported events: consent.given, consent.updated, consent.rejected, banner.shown.

CerezBanner.on('consent.given', (data) => {
    console.log('Onay verildi:', data.categories);

    if (data.categories.marketing) {
        // Facebook Pixel başlat
        fbq('init', 'YOUR_PIXEL_ID');
    }
});
CerezBanner.reset()

Clears the current consent and shows the banner again. Suitable for functions such as "Reset My Preferences".

CerezBanner.reset(); // cb_consent cookie silinir, banner yeniden açılır
CerezBanner.hide()

Hides the banner programmatically. No consent is recorded; only the visibility changes.

CerezBanner.hide(); // Banner DOM'dan kaldırılmaz, gizlenir
SCRIPT BLOCKING

Block 3rd-Party Scripts Before Consent

Scripts such as GA4, Facebook Pixel and Hotjar must not run until consent is granted (a KVKK/GDPR requirement). The installation code automatically holds back tags that known providers add with JavaScript (such as the GTM and Meta Pixel snippets) until consent is given. Script tags written directly into the page (<script src>) are downloaded by the browser before any code runs; mark them with the type="text/plain" and data-cb-category attributes.

Non-compliant (the script runs immediately)

<!-- YANLIŞ: script anında yüklenir -->
<script
  src="https://www.googletagmanager.com/gtag/js?id=G-XXX"
></script>

Compliant (runs after consent)

<!-- DOĞRU: sadece onay sonrası yüklenir -->
<script
  type="text/plain"
  src="https://www.googletagmanager.com/gtag/js?id=G-XXX"
  data-cb-category="analytics"
></script>

Inline Script Blocking

<!-- Inline script için: type="text/plain" + data-cb-category -->
<script type="text/plain" data-cb-category="marketing">
    fbq('init', 'PIXEL_ID');
    fbq('track', 'PageView');
</script>
Supported Categories necessary (cannot be blocked), analytics, marketing, functional

Blocking Embedded Content (iframe)

For YouTube, Vimeo, Google Maps and social network embeds, write data-cb-src instead of src and set the category with data-cb-category. The content does not load until consent is given; a placeholder of the same size with "Allow and show" and "Preferences" buttons appears in its place. Once allowed, all embeds in the same category load; when consent is withdrawn they return to the placeholder. For YouTube the youtube-nocookie.com address is recommended.

<iframe data-cb-src="https://www.youtube-nocookie.com/embed/VIDEO_ID"
  data-cb-category="marketing" width="560" height="315" title="Video"></iframe>
Limit An unmarked iframe written directly into the page with src cannot be blocked: the browser loads it before the installation code runs. The installation code only catches known embeds added later by JavaScript (YouTube, Vimeo, Google Maps, Instagram, X, TikTok, Facebook) on a best-effort basis.
GOOGLE CONSENT MODE V2

Automatic Integration, a Single Toggle

Turn on the "Consent Mode v2" toggle under Admin Panel > Site Settings > Google Integration. The SDK automatically manages gtag('consent', 'default', {...}) and the update signals.

The SDK Does This Automatically

// Sayfa yüklenir yüklenmez, kullanıcı henüz karar vermedi
gtag('consent', 'default', {
    'ad_storage': 'denied',
    'ad_user_data': 'denied',
    'ad_personalization': 'denied',
    'analytics_storage': 'denied',
    'functionality_storage': 'denied',
    'personalization_storage': 'denied',
    'security_storage': 'granted'
});

// Kullanıcı onay verdikten sonra, analytics + marketing kabul edildi
gtag('consent', 'update', {
    'ad_storage': 'granted',
    'analytics_storage': 'granted'
});

Ayrıntılı GCM v2 rehberi için Google Consent Mode v2 sayfasına bakın.

ADVANCED SETTINGS

Customization and Configuration

You can customize the SDK's behavior by adding extra attributes to the embed code.

Preview Mode

By adding ?cb_preview=true to the URL, you can bypass the existing consent and show the banner every time. Ideal for testing and development.

Language Preference

Under Admin Panel > Site Settings > Banner Language, you can select a fixed language or set automatic switching (auto) based on the visitor's browser language. TR / EN / DE are supported.

CSP Compatibility

If your site has a CSP, allow https://cerez.io in script-src, connect-src, style-src, font-src and img-src. If you use a nonce, the SDK passes the tag's nonce to its own elements. Details: CSP section.

sessionStorage Cache

After loading, the SDK stores the banner configuration in sessionStorage. No further server call is made within the same session; page load time is reduced.

Consent Duration

Set the validity period of the cb_consent cookie under Admin Panel > Site Settings > Consent Duration (default 180 days). The recommended period for KVKK compliance is 6 months.

IP Restriction

Restrict API access by opening the IP Restriction toggle under Admin Panel > Installation and entering the allowed IP addresses (CIDR notation supported).

Keyboard and Focus

When the banner opens, focus moves to the banner itself and the Tab key cycles inside it. The Esc key does the same as "Necessary Only". When the banner closes, focus returns to the element that opened it. The accept and reject buttons have the same size and the same color; this equality cannot be turned off.
CONTENT SECURITY POLICY

cerez.io domains to add to your site's CSP

If your site sends a Content-Security-Policy header, allow https://cerez.io in the directives below so the installation code can run. Your trackers' own domains (Google, Meta and so on) are needed separately; cerez.io does not load them until consent is given.

cerez.io sources per directive
DirectiveValueWhy
script-srchttps://cerez.ioInstallation code (loader.js), cookie banner and accessibility tool files.
connect-srchttps://cerez.ioBanner configuration, consent log, session and usage counter requests, language packs; with a regional rule, the country code request.
style-srchttps://cerez.ioFont stylesheet. The banner and the tool add their styles with a <style> element: without a nonce, style-src also needs 'unsafe-inline'.
font-srchttps://cerez.ioFonts of the banner and the accessibility tool. If not allowed, both keep working with system fonts; the browser console shows a CSP error.
img-srchttps://cerez.io data:Logo in the banner and the tool; data: for the accessibility tool's large cursor feature.

Policies that use a nonce

If your policy uses a nonce (script-src 'nonce-...'), put the same nonce on the installation code tag. The SDK passes it to the script and style elements it creates, so style-src does not need 'unsafe-inline'.

<script nonce="SAYFANIZIN-NONCE-DEGERI" src="https://cerez.io/sdk/loader.js" data-cerez-key="API_ANAHTARINIZ"></script>

Example policy (site without a nonce)

Content-Security-Policy:
  script-src 'self' https://cerez.io;
  connect-src 'self' https://cerez.io;
  style-src 'self' 'unsafe-inline' https://cerez.io;
  font-src 'self' https://cerez.io;
  img-src 'self' data: https://cerez.io

Keep your own directives; only add the cerez.io domain.

FREQUENTLY ASKED QUESTIONS

Technical Questions

Kısa cevap: SDK cerez.io sunucularından servis edilir ve otomatik güncellenir. Self-hosting sunulmaz; bu sayede yeni özellikler ve güvenlik güncellemeleri otomatik olarak tüm müşterilere ulaşır.

Start with one line of code

Create an account, add a domain, copy the code. The SDK handles the rest.