Server SDK: consent on the backend

Why

The banner blocks the browser, but half of the processing starts server-side: GA4 Measurement Protocol, CRM sync, attribution cookies. @flowconsent/server-sdk reads the first-party cookie set by the banner (versioned v1 contract) and returns a typed decision, denied by default when the cookie is missing, unreadable or stale.

Install

npm install @flowconsent/server-sdk

Zero dependencies, edge-compatible (Vercel, Cloudflare Workers, Node ≥ 18).

Read the decision

import { readConsent } from '@flowconsent/server-sdk'
 
const decision = readConsent(request)
if (decision.can('analytics')) {
  // send the GA4 Measurement Protocol event
}
// decision.reason: 'ok', 'no_cookie', 'expired', 'version_mismatch'…

decision.can('google-analytics') also works per service. Pass expectedConfigHash (your banner's) to automatically invalidate choices made before a configuration change.

Verify webhooks

Consent webhooks are signed (HMAC-SHA256, X-FlowConsent-Signature header, Stripe-style):

import { verifyWebhookSignature } from '@flowconsent/server-sdk'
const check = await verifyWebhookSignature(rawBody, signatureHeader, secret)
if (!check.valid) return new Response('invalid', { status: 400 })

The secret is shown once, when the webhook is created (app or MCP configure_consent_webhook).