Consenti
Tutorial — Frontend + Backend — Step 2 of 9
RestartSwitch to Frontend Only →

Configure Backend

Pick a storage driver and start the admin dashboard.

123456789

The json driver above works with zero installation — good for local dev. Swap the storage.driver before going to production:

ts
storage: { driver: 'node:sqlite', path: './consenti-data' }   // built-in, Node 22.5+
// or
storage: { driver: 'postgresql', uri: process.env.DATABASE_URL, path: './consenti-data' }
// or
storage: { driver: 'mysql', uri: process.env.DATABASE_URL, path: './consenti-data' }
// or
storage: { driver: 'mongodb', uri: process.env.MONGODB_URI, path: './consenti-data' }

auth.mode: 'local' is a username/password admin login — good for a single team. Switch to 'jwt' for API consumers or 'oidc'/'saml' for enterprise SSO — see Auth Modes.

Storage and auth are just two of the config sections createConsenti() takes. Pick whichever of these your project needs — none are required, all are independent.

compliance — geo-routing and custom resolvers

Controls which cookie consent model applies to a visitor. type: 'auto' (the default) geo-resolves per visitor; a fixed group ID applies one group to everyone.

compliance examples
ts
// Zero-dep geo routing (timezone + Accept-Language heuristic) — the default
compliance: { type: 'auto', geoDataProvider: 'default' }

// IP-based, local lookup (npm install geoip-lite)
compliance: { type: 'auto', geoDataProvider: 'geoip' }

// IP-based, official MaxMind SDK — most accurate, requires a .mmdb file
compliance: { type: 'auto', geoDataProvider: 'maxmind' }

// Fixed group — e.g. a GDPR-only product serving only EU visitors
compliance: { type: 'opt-in' }

// Your own resolver — integrate any GeoIP SaaS
compliance: {
  type: 'auto',
  geoDataProvider: async ({ ip, timezone, language }) => {
    const res = await fetch(`https://api.mygeoip.com/${ip}`)
    const data = await res.json()
    return { country: data.country_code, region: data.region, locale: data.locale ?? null }
  },
}

See Geo-Routing & Auto-Detection for a full comparison of every resolver.

tcf — IAB Transparency & Consent Framework v2.2

tcf example
ts
tcf: {
  enabled: true,
  cmpId: 42,        // your IAB-registered CMP ID — required
  cmpVersion: 1,     // your CMP software version — required
}
⚠️cmpId/cmpVersion here must match the widget's own compliance.tcf config, and must be a real IAB-registered ID in production.

handleCache — CDN / edge cache integration

Called whenever Consenti writes or removes locale JSON files on disk — wire it up to purge or warm a CDN, nginx proxy cache, or any edge layer.

handleCache example
ts
handleCache: (paths, version, isPurge) => {
  if (isPurge) {
    for (const p of paths) cdnClient.purge(p)
  } else {
    for (const p of paths) cdnClient.warm(p)
  }
}

rateLimit — public API throttling

rateLimit examples
ts
// Tighter limit for high-traffic sites
rateLimit: { windowMs: 60_000, maxRequests: 30 } // 30 req/min per IP

// Disable entirely (you handle rate limiting upstream)
rateLimit: { enabled: false }

dataRetention — automatic GDPR data minimisation

dataRetention example
ts
// Keep consent records for 1 year, then purge automatically (nightly job)
dataRetention: { purgeAfterDays: 365 }

multiTenant — one deployment, many tenants

multiTenant example
ts
multiTenant: { enabled: true }

// Clients must then pass:
// X-Tenant-ID: acme-corp
// or: GET /consenti/api/v1/consent?tenantId=acme-corp

basePath — change the /consenti prefix

ts
basePath: '/cmp' // dashboard now at /cmp/, API at /cmp/api/v1/
ℹ️See API Advanced Configuration for every section above plus ageGate, plugins, branding, consentSigningKey, s3Api, and trustedProxies — and Choosing a Storage Driver for the storage comparison.
PreviousNext: Update & Add Profiles