CheckboxDocs
Tools

The JavaScript snippet

View as Markdown Open in Claude

One script tag in your root layout lets Checkbox see what real visitors see on your pricing and checkout pages — including A/B variants — and re-check when a page changes.

The snippet is a small script (/s.js) you put in the <head> of every page. On your own pages it captures the compliance-relevant parts of what visitors actually see — the pay button, the terms near it, consent checkboxes, cancellation links — so Checkbox notices when a deploy or an A/B test changes them, and re-scans.

HTML
<script async src="https://app.checkbox.site/s.js" data-key="pk_6ea05a319dc611d8ce3327fe" data-api="https://app.checkbox.site"></script>

Your site's exact tag is in install.script_tag on the site object. checkbox init (CLI) and the setup_checkbox MCP flow add it to your root layout for you, between checkbox:snippet:start / checkbox:snippet:end markers (a JSX comment, an HTML comment, a Nuxt client plugin or the Next.js pages-router _document, depending on the framework), and reports where with snippet_installed_in.

What it sends, and what it never does

  • After load, and again after significant DOM changes (debounced, at most 5 sends per page view, skipped when nothing changed), it extracts the page and sends it to https://app.checkbox.site/ingest/<key> with sendBeacon.
  • No cookies, no storage, no form-field values. Personal data is redacted before sending.
  • It is wrapped so it can never throw into your page, and it loads async.
  • data-sample="0.1" captures only that fraction of page views.

How the captures are used

Snippet captures are unauthenticated (anyone could post to an ingest URL), so the rules engine treats them as corroboration: they never make a check pass on their own, and with scanner coverage a snippet-only failure is needs_review. They are still valuable: a changed checkout page triggers a page_changed re-scan, and A/B variants the synthetic shopper did not see become visible. To prove a capture came from your own server-rendered page, sign the tag (data-sig, set up in the dashboard under Site → Install).

Rendering the disclosure

With data-disclosure="1" on the tag, the snippet also loads a renderer that fills [data-checkbox-disclosure] placeholders with your verified renewal terms — a no-build way to show the disclosure, opt-in from Site → Fixes. For new work, prefer Checkbox Elements, which also records consent.

Content-Security-Policy

Allow script-src https://app.checkbox.site and connect-src https://app.checkbox.site.

Checkbox is compliance software, not a law firm; nothing in these docs is legal advice (details). For AI agents: every page is available as Markdown at the same URL plus .md; the index is /llms.txt.