Consent and security

Consent modes

The Hosted Package supports three consent modes.

anonymous

data-tiquo-consent="anonymous"

Anonymous consent allows website analytics without linking events to a known customer identity.

This mode can track page views, sessions, attribution, engagement, device data, and custom anonymous events.

full

window.Tiquo.setConsent("full");

Full consent allows analytics and known-customer linking. When a customer signs in, Tiquo can connect website activity to that customer record.

Use this after your consent banner or privacy flow has permission to link activity to an identifiable customer.

none

window.Tiquo.setConsent("none");

No analytics events are sent while consent is none.

Recommended default

Use anonymous in the script tag:

<script
  src="https://tiquo.app/tiquo/v1/tiquo.js"
  data-tiquo-public-key="pk_dom_your_public_key"
  data-tiquo-consent="anonymous"
  defer
></script>

Then call setConsent("full") only after the visitor has accepted the level of tracking your privacy policy requires.

Domain protection

Tiquo checks the request origin against the domains configured for your Website SDK public key.

Requests from unconfigured websites are rejected. This prevents another website from copying your public key and using it from an unapproved domain.

Public key safety

The Website SDK public key is safe to expose in browser code. It identifies the Tiquo organization and allowed website configuration, but it is not a secret.

Never put private API keys, admin API keys, or server secrets in the hosted script or website-builder custom code.

Token handling

The Hosted Package manages customer session tokens internally so it can call customer APIs after login. It does not expose raw token getter methods on window.Tiquo.

Because the script runs in the browser, any third-party scripts on the same page should be treated as part of your website security boundary.

For authenticated Tiquo iframes, the package exchanges a short-lived, one-time handoff token with the exact iframe origin using postMessage. It does not append access or refresh tokens to iframe URLs. Organization, origin, iframe window, nonce, and handoff version are checked before the token is accepted.

Content rendering safety

Customer, order, booking, and membership fields are rendered as text content by default.

When a field is rendered into an anchor element, the Hosted Package only allows safe link protocols such as https, http, mailto, tel, and relative URLs.

Profile-photo image and background data attributes accept only HTTP and HTTPS URLs.