Consent and security

Understand consent modes, domain restrictions, and security behavior for the Tiquo Hosted Package

The Hosted Package supports three consent modes.

`anonymous`

data-tiquo-consent="anonymous"

Anonymous consent allows website analytics without linking events to a known customer identity.

This mode can track page views, sessions, attribution, engagement, device data, and custom anonymous events.

`full`

window.Tiquo.setConsent("full");

Full consent allows analytics and known-customer linking. When a customer signs in, Tiquo can connect website activity to that customer record.

Use this after your consent banner or privacy flow has permission to link activity to an identifiable customer.

`none`

window.Tiquo.setConsent("none");

No analytics events are sent while consent is none.

Recommended default

Use anonymous in the script tag:

<script
  src="https://tiquo.app/tiquo/v1/tiquo.js"
  data-tiquo-public-key="pk_dom_your_public_key"
  data-tiquo-consent="anonymous"
  defer
></script>

Then call setConsent("full") only after the visitor has accepted the level of tracking your privacy policy requires.

Analytics consent is separate from customer communication preferences. setConsent("full") does not set Marketing Opt-In or SMS Opt-In. Use an authenticated profile form to let a customer check or uncheck either customer-editable consent preference. Only the signed-in customer's profile can be updated through this route.

Enquiry forms accept enquiry-type answers separately from fill-only customer parameters. customer.customerParameterValues and legacy customer.details can initialize missing customer-editable parameters, but never overwrite a stored value. Marketing/SMS defaults are already stored and cannot be changed through an enquiry. An enquiry parameter with the same label as a customer consent parameter is still only an enquiry answer. Server-side integrations can separately use the Admin API with a write-scoped secret key and staff-editable parameters.

Domain protection

Tiquo checks the request origin against the domains configured for your Website SDK public key.

Requests from unconfigured websites are rejected. This prevents another website from copying your public key and using it from an unapproved domain.

Public key safety

The Website SDK public key is safe to expose in browser code. It identifies the Tiquo organization and allowed website configuration, but it is not a secret.

Never put private API keys, admin API keys, or server secrets in the hosted script or website-builder custom code.

Token handling

The Hosted Package manages customer session tokens internally so it can call customer APIs after login. It does not expose raw token getter methods on window.Tiquo.

Because the script runs in the browser, any third-party scripts on the same page should be treated as part of your website security boundary.

For authenticated Tiquo iframes, the package exchanges a short-lived, one-time handoff token with the exact iframe origin using postMessage. It does not append access or refresh tokens to iframe URLs. Organization, origin, iframe window, nonce, and handoff version are checked before the token is accepted.

Content rendering safety

Customer, order, booking, and membership fields are rendered as text content by default.

When a field is rendered into an anchor element, the Hosted Package only allows safe link protocols such as https, http, mailto, tel, and relative URLs.

Profile-photo image and background data attributes accept only HTTP and HTTPS URLs.

Consent and security

Sur cette page