Configure the banner

Configure the banner through Consent settings in app.lepsto.com or the corresponding MCP tools. You can change its theme, logo and placement, preferences trigger, and consent cookie domain.

Theme and customization changes merge with saved settings. The banner reads configuration on each page load, but caches can delay what visitors see by up to five minutes.

Before you start

Member access with product write scope for theme, customization and floating-icon changes.
Admin access for cookie domain changes, which can leave existing choices stored on the previous domain.
A brand color in hex, rgb()/rgba() or hsl()/hsla() form. Named CSS colors are rejected because their contrast cannot be calculated.
Any logo or cover image hosted at an absolute https URL, no longer than 2048 characters.

Set the theme

Use the appearance panel in the app, or follow these MCP steps. Replace the example color and example.com asset URL with your own.

Set the theme with consent_config_theme_upsert:
```
consent_config_theme_upsert
  brandColor: "#2F6BFF"
  surface: "dark"
  corners: "rounded"
```
The tool also accepts font and an overrides object for slots such as textColor, backgroundColor, primaryTextColor, borderColor and focusColor. Valid corners values are sharp, rounded and pill. Consent derives the remaining theme values from your settings.
Set images and placement with consent_config_customization_upsert:
```
consent_config_customization_upsert
  logoUrl: "https://example.com/logo.svg"
  position: "bottom"
```
Other fields include coverUrl, logoAlign and contentAlign.
Read back the saved configuration with consent_dashboard_config_get. Each successful update saves immediately; no separate publish operation is needed. Omitted fields keep their values.
Reload your site and check the banner, allowing for the cache windows below.

The banner lives in a shadow root and sets its own CSS custom properties. Page styles cannot be used to customize it; use the configuration settings.

Two rules the resolver enforces

Image URLs must use HTTPS. Invalid or non-HTTPS URLs, including http:, data: and javascript:, are dropped. Images load from the host you supply, exposing the visitor’s IP address to that host; Consent does not store the assets.

An explicit primary text color must pass a contrast check. The resolver rejects a contrast ratio below 3.0 against the button fill and reports the measured ratio. This is the threshold used for large text and UI components, not a claim that every text style meets every accessibility requirement. Colors whose contrast cannot be computed are also rejected.

If you omit the text color, Consent derives it from the brand color. The bundle and configuration response use the same derivation.

Keep the choice reopenable

After a visitor decides, the floating icon reopens their preferences. To use your own trigger instead:

Add the trigger element to your site.

Call consent_config_floating_icon_upsert with product write scope, or change the floating-icon settings in the app:

consent_config_floating_icon_upsert
  floatingIcon:
    enabled: false
    position: "bottom-right"
    customSelector: "#cookie-settings"

Replace #cookie-settings with your element’s selector and confirm that clicking it opens preferences after a decision.

The floatingIcon object requires enabled, position and customSelector. Disabling the icon without a custom trigger is rejected. The selector must be valid CSS and contain 1 to 256 printable ASCII characters.

By default, the runtime probes the browser to find your registrable domain and writes lepsto_consent there. Use an override when separate products on subdomains need separate choices.

With Admin access, call:

consent_config_cookie_domain_upsert
  cookieDomain: "docs.example.com"

Replace docs.example.com with the host that should receive the cookie.
Make a decision on that host and inspect the cookie’s Domain in the browser.

Send cookieDomain: null or an empty string to restore automatic derivation.

The override must be lowercase, have at least one dot, be at most 253 characters and not be an IP address. It cannot equal or be an ancestor of a platform deployment domain, which would allow a cookie to cover other tenants.

The browser also checks the actual page hostname. If the override is not its suffix, the runtime ignores it and derives the domain automatically.

Changing the domain does not remove wider cookies already stored on neighboring subdomains. They expire on their original schedule. On the current host, the most recent decision takes precedence.

Check it worked

Call consent_dashboard_config_get to check the saved theme, customization and floating-icon settings. It does not return the cookie domain override.
Open your site in a fresh browser profile. Check appearance after allowing up to five minutes for a current bundle, then hard-reload if needed.
Make a decision and reopen preferences using the floating icon or your custom trigger.
Inspect lepsto_consent in the browser’s application panel. Its Domain should match the valid override or the automatically derived domain.

Freshness

The configuration response is cached for one minute in the browser and any CDN, with an ETag. A revalidation with no changes returns 304.

The banner bundle embeds the theme and is cached for five minutes. A stale bundle can briefly show previous colors until the configuration fetch applies the new theme. Allow five minutes for a current first frame.

An unconfigured product receives the default theme, customization and floating icon, no cookie domain override, and the built-in Consent provider.

Next steps

The banner runtime: how automatic cookie domain selection works.
Declare your providers and cookies: configure the resources disclosed and blocked.

Was this page helpful?