Developer overview

The Cookie Munch API is a plain HTTP/JSON surface — no SDK is required to integrate, though a thin client makes the common calls (fetch config, log consent, read stats) more convenient. Every site is identified by its cbid (Cookie Munch ID), issued when you register the site in the dashboard.

Two credential types cover the whole surface: a session Bearer token for the dashboard and account-management routes, and a per-org API key for the public /v1 developer endpoints (config reads, consent stats, exports). Public embed routes (/config, /consent.js, consent ingest) are unauthenticated by design — the embed itself is public JS running on your visitors' browsers.

A minimal server-side read of a site's current banner config looks like this:

curl -H "Authorization: Bearer $COOKIEMUNCH_API_KEY" \
  https://api.cookiemunch.net/v1/config/YOUR_SITE_ID

From here, the rest of the developer docs walk through consent logging, webhooks, the banner-library API for reusable designs, and the granular TCF endpoints.