# The JavaScript snippet

> One script tag in your root layout lets Checkbox see what real visitors see on your pricing and checkout pages — including A/B variants — and re-check when a page changes.

The snippet is a small script (`/s.js`) you put in the `<head>` of every page. On your own pages it captures the
compliance-relevant parts of what visitors actually see — the pay button, the terms near it, consent checkboxes,
cancellation links — so Checkbox notices when a deploy or an A/B test changes them, and re-scans.

```html
<script async src="https://app.checkbox.site/s.js" data-key="pk_6ea05a319dc611d8ce3327fe" data-api="https://app.checkbox.site"></script>
```

Your site's exact tag is in `install.script_tag` on the [site object](https://checkbox.site/docs/api/sites#the-site-object).
`checkbox init` (CLI) and the `setup_checkbox` MCP flow add it to your root layout for you, between `checkbox:snippet:start` / `checkbox:snippet:end`
markers (a JSX comment, an HTML comment, a Nuxt client plugin or the Next.js pages-router `_document`, depending on the
framework), and reports where with `snippet_installed_in`.

## What it sends, and what it never does {#privacy}

- After load, and again after significant DOM changes (debounced, at most 5 sends per page view, skipped when nothing
  changed), it extracts the page and sends it to `https://app.checkbox.site/ingest/<key>` with `sendBeacon`.
- **No cookies, no storage, no form-field values.** Personal data is redacted before sending.
- It is wrapped so it can never throw into your page, and it loads `async`.
- `data-sample="0.1"` captures only that fraction of page views.

## How the captures are used {#evidence}

Snippet captures are unauthenticated (anyone could post to an ingest URL), so the rules engine treats them as
corroboration: they never make a check pass on their own, and with scanner coverage a snippet-only failure is
`needs_review`. They are still valuable: a changed checkout page triggers a `page_changed` re-scan, and A/B variants the
synthetic shopper did not see become visible. To prove a capture came from your own server-rendered page, sign the tag
(`data-sig`, set up in the dashboard under **Site → Install**).

## Rendering the disclosure {#disclosure}

With `data-disclosure="1"` on the tag, the snippet also loads a renderer that fills `[data-checkbox-disclosure]`
placeholders with your verified renewal terms — a no-build way to show the disclosure, opt-in from **Site → Fixes**.
For new work, prefer [Checkbox Elements](https://checkbox.site/docs/elements), which also records consent.

## Content-Security-Policy {#csp}

Allow `script-src https://app.checkbox.site` and `connect-src https://app.checkbox.site`.