Server SDK: consent on the backend
Read the consent decision in your server code and verify signed webhooks.
Why
The banner blocks the browser, but half of the processing starts server-side: GA4 Measurement Protocol, CRM sync, attribution cookies. @flowconsent/server-sdk reads the first-party cookie set by the banner (versioned v1 contract) and returns a typed decision — denied by default when the cookie is missing, unreadable or stale.
Install
npm install @flowconsent/server-sdkZero dependencies, edge-compatible (Vercel, Cloudflare Workers, Node ≥ 18).
Read the decision
import { readConsent } from '@flowconsent/server-sdk'
const decision = readConsent(request)
if (decision.can('analytics')) {
// send the GA4 Measurement Protocol event
}
// decision.reason: 'ok', 'no_cookie', 'expired', 'version_mismatch'…decision.can('google-analytics') also works per service. Pass expectedConfigHash (your banner's) to automatically invalidate choices made before a configuration change.
Verify webhooks
Consent webhooks are signed (HMAC-SHA256, X-FlowConsent-Signature header, Stripe-style):
import { verifyWebhookSignature } from '@flowconsent/server-sdk'
const check = await verifyWebhookSignature(rawBody, signatureHeader, secret)
if (!check.valid) return new Response('invalid', { status: 400 })The secret is shown once, when the webhook is created (app or MCP configure_consent_webhook).