--- title: Configuration description: Every option you can pass to the c15t script tag on a plain HTML page through a queued config call, including scripts with callbacks, the network blocker, theme tokens, presentation, translations and storage. group: frameworks lastModified: "2026-10-10T16:01:45+01:00" --- ## Pass options before the tag Attributes on the script tag cover the common options. For everything else, queue a `config` call in an inline script before the tag: ```html ``` The tag has `defer`, so an inline script anywhere in `` runs before it. Later `config` calls win over earlier ones, and all of them win over the tag's attributes. `ui`, `ui.banner` and `ui.dialog` merge key by key; other options replace the earlier value. A `config` call after the client started does nothing and logs a warning. [window.c15t API](/docs/frameworks/html/api#how-options-merge) explains the order. A `config` object can hold functions, such as script callbacks, because it never leaves the page. ## Connection and policy The `init()` and `createConsentClient()` of the `@c15t/browser` ES module, `@c15t/browser/headless` and `@c15t/browser/iab` take `mode` as a factory and none of the connection options below it. The script-tag builds and the `@c15t/browser/hosted` and `@c15t/browser/offline` entries take the rest of the table: `c15t.js` and `@c15t/browser/hosted` accept hosted mode only and require a backend URL or hosted factory, and `c15t.offline.js` and `@c15t/browser/offline` accept offline mode only. |Option|Type|Default|What it does| |--|--|--|--| |`mode`|A transport factory. Script-tag builds also take `'hosted'`, `'offline'` or `'manifest'`.|Required in the ES modules. Script-tag builds pick it from the other options.|A factory from `manifest()`, `hosted()`, `offline()` or `custom()` is used as is; see [consent modes](/docs/concepts/modes). In the script-tag builds, `manifest` when `manifest` or `manifestURL` is set, `hosted` when `backendURL` is set, otherwise `offline`. Hosted mode without `backendURL` throws.| |`backendURL`|`string`|none|Script-tag builds, `/hosted` and `/offline` entries. Your Inth or self-hosted backend URL, for hosted and manifest modes. In the ES modules, pass it to the factory, such as `hosted({ backendURL })`.| |`manifest`|`ConsentManifest`|none|Script-tag builds. The backend's policy manifest, inlined in the page, for manifest mode. In the ES modules, `manifest({ snapshot })`.| |`manifestURL`|`string`|none|Script-tag builds. Where manifest mode fetches the manifest. A URL that ends in `/manifest` also gives the backend URL; any other URL needs `backendURL` too. In the ES modules, `manifest({ manifestURL })`.| |`policyRules`|array of policy rules or preset names|recommended rules|Script-tag builds and the `/hosted` and `/offline` entries. Offline mode only. A preset name such as `'europeOptIn'` stands for that preset in `policyRulePresets`. An unknown name throws. In the ES modules, `offline({ policyRules })` with rule objects.| |`overrides`|`{ country?, region?, language?, gpc? }`|none|The visitor's location, language or GPC signal, when the page knows it. Policy matching uses these instead of detection.| |`prefetch`|kernel configuration|none|A server-resolved init answer. When it carries a resolved policy, the client renders from it and does not call `/init`.| |`enabled`|`boolean`|`true`|`false` grants every category, shows no UI and loads every configured script at once.| The [attributes reference](/docs/frameworks/html/attributes-and-api#choose-a-mode) compares the modes and their bundle files. ## Scripts, blockers and data |Option|Type|Default|What it does| |--|--|--|--| |`scripts`|`Script[]`|`[]`|Vendor scripts to load once their category is allowed. Each entry needs `id`, `category`, and `src` or `textContent`.| |`consentCategories`|category names|categories your scripts, iframes and rules use|The categories the preference dialog offers, within the policy's scope. `necessary` is always included.| |`networkBlocker`|`{ rules, enabled?, logBlockedRequests?, onRequestBlocked? }` or `false`|off|Hold `fetch` and `XMLHttpRequest` calls that match a rule until the rule's category is allowed.| |`iframeBlocker`|`{ disableAutomaticBlocking? }` or `false`|on|Gate iframes that carry `data-category` or `data-vendor`. `false` turns it off. With `disableAutomaticBlocking: true`, c15t checks iframes only when you call `processIframes()`.| |`nonce`|`string`|none|Content Security Policy nonce for the stock UI's `