@c15t/backend: Self-hosted consent management backend

Run the c15t cookie consent backend on your own server and database. It resolves consent policies for GDPR and other privacy laws, stores consent records and audit history, and serves every c15t frontend through one web Request handler.

c15t is used by 2,100+ sites, including expo.dev, zed.dev, unkey.dev, mintlify.com, and sazabi.com.

Key Features

• You own the data: consent records stay in your PostgreSQL, MySQL, or SQLite database
• Policy rules by region, with presets such as policyRulePresets.europeOptIn()
• One web-standard Request to Response handler that mounts in Next.js, Nuxt, SvelteKit, TanStack Start, or any server
• Geolocation from host headers, server-side translations, and audit logs
• IAB TCF configuration with the Global Vendor List and custom vendors
• The same API as Inth, so frontends change only the backend URL

Prerequisites

• Node.js 20.19 or later
• A PostgreSQL, MySQL, or SQLite database, plus its driver: @effect/sql-pg, @effect/sql-mysql2, or @effect/sql-sqlite-node
• A server that runs Node.js. A static export cannot run the backend

Installation

pnpm add @c15t/backend @effect/sql-sqlite-node

Install the driver version that the backend lists as a peer dependency. Do not want to run a database? Inth runs this backend for you.

Usage

1. Create c15t-backend.config.ts with your database, trusted origins, and policy rules

// c15t-backend.config.ts
import { defineConfig, policyRulePresets } from '@c15t/backend'

export default defineConfig({
  database: { dialect: 'sqlite', filename: './consent.db' },
  trustedOrigins: ['localhost'],
  manifest: { policyRules: [policyRulePresets.europeOptIn()] },
})

2. Create the schema: npx @c15t/cli self-host migrate --config ./c15t-backend.config.ts --plan, then run it again with --apply
3. Mount the handler on a catch-all route for GET, POST, PUT, PATCH, and OPTIONS

// app/api/c15t/[[...path]]/route.ts (Next.js)
import { c15tInstance } from '@c15t/backend'

import config from '../../../../c15t-backend.config'

export const runtime = 'nodejs'
const backend = c15tInstance({ ...config, basePath: '/api/c15t' })

export const GET = (request: Request) => backend.handler(request)
export const POST = GET
export const PUT = GET
export const PATCH = GET
export const OPTIONS = GET

4. Point your frontend at the backend URL, such as https://app.example.com/api/c15t, where the quickstart asks for the Inth URL
5. For other servers, PostgreSQL, and deployment checks, see the self-hosting guide

Documentation

See the documentation for guides, API reference, and examples.

Hosted or Self-Hosted

Self-host when you need to run the service and its database yourself. You then own provisioning, migrations, backups, policy configuration, signing secrets, availability, and upgrades.

Inth runs the same backend for you, with a dashboard, audit history, and a managed IAB CMP ID. Your frontend code is the same either way.

Support

• Join our Discord community
• Open an issue on our GitHub repository
• Visit inth.com and use the chat widget
• Contact our support team via email [email protected]

Contributing

• Read the contribution guidelines before you open a pull request
• Follow the code of conduct

Security

Do not open a public issue for a security vulnerability. Report it privately through GitHub's vulnerability reporting. We examine every valid report.

• Do not share the vulnerability in public forums, issues, or pull requests
• Give the steps to reproduce it and the versions it affects
• Give us time to release a fix before you disclose it

License

Apache License 2.0

Built by Inth