Hosted pages

Run your own consent banner and support chat on the partner portal and join pages served on your domain.

Embed
Preview of the card
<a href="https://referalli.com/docs/hosted-pages"><img src="https://referalli.com/docs/_api/public/orgs/07f432f4-34b9-46a7-aaad-c0e395d2e4f9/spaces/2bf4f614-3630-4fbf-85f9-5ecafa6b7d97/pages/95311469-254a-4c4d-8af3-77a9b7001683/social-card.svg?v=3e7ae33eec8b" alt="Hosted pages" width="600" height="315"></a>

On your own portal domain (for example partners.yourapp.com, see Settings → Domains), Referalli serves the partner portal and the /join pages. Those pages run your consent banner and your support chat, never Referalli's, and send a Content-Security-Policy that admits exactly what you enable.

Set it in Settings → Domains → Consent and chat on your portal domain, or with PUT /v1/org/hosted-pages. Changes reach your domain within a minute.

Option

What you give

None

Nothing. The portal sets only its strictly necessary sign-in cookie.

Built-in notice

Your privacy policy URL. A small, accessible notice says the portal uses only necessary cookies and links your policy.

Cookie Munch

Your site id (cbid). Add your portal domain as an alias on that Cookie Munch site. Check setup confirms the site exists.

OneTrust, Cookiebot, Usercentrics, Didomi, Osano, Termly, iubenda

The script URL from the vendor's embed snippet (https, on the vendor's own hosts) and its attributes, such as data-domain-script or data-cbid. The vendor's documented origins are added to the policy.

Custom

Any https script URL, plus every origin it needs per directive, and optionally the function that opens its preferences.

The account menu's Cookie settings item opens your tool's preference centre.

curl -X PUT $BASE/v1/org/hosted-pages -H "Authorization: Bearer $KEY" -H "content-type: application/json" -d '{
  "consent": { "adapter": "onetrust", "config": { "scriptUrl": "https://cdn.cookielaw.org/scripttemplates/otSDKStub.js", "attrs": { "data-domain-script": "0190-..." } } },
  "chat": { "adapter": "intercom", "config": { "appId": "abc123xy", "region": "eu" } }
}'

Support chat

Chatly (public id), Intercom (app id and region), Crisp (website id), or a custom script with its origins.

Content-Security-Policy

The policy starts from this origin only (images may be any https URL, for logos and partner assets) and adds the origins your consent tool and chat declare, plus any you list under Other origins (https or wss, no wildcards, no keywords). GET /v1/org/hosted-pages shows it under served.csp. With nothing enabled it contains no third-party origin.

Updated