Step 1 — Pre-flight Check

Before you touch any code, confirm three things: your customer ID, your consent setup, and whether your site uses a Content Security Policy.

1.1 Your fraud0 customer ID (cid)

Log in to your fraud0 Dashboard, select the tag you are implementing, and open Integrations → Tag Management. Copy the cid shown there. The cid is your tag’s unique ID — each tag has its own cid, so make sure you copy the one for the tag you are working on. Every code snippet in this guide uses this value wherever you see {{fraud0 cid}}.

1.2 The most important rule

1.3 How is your site set up today?

Answer these three questions — they determine which embed path is right for you in the next step.

	Question	Notes
Q1	Is there a Consent Management Platform (CMP) on the site?	If no CMP, any embed path works. If yes, continue.
Q2	Does the GTM container load before the CMP banner is interacted with?	”Before” = the `<script>` for `googletagmanager.com` is in the `<head>` and runs unconditionally.
Q3	Does your website enforce a Content Security Policy `script-src` directive?	If yes, you will need to allow-list the fraud0 host (see 1.4 below).

Your answers determine which option to choose in Steps 2–3.

1.4 Content Security Policy — extend it if you have one

If your site sends a Content-Security-Policy header (or <meta http-equiv="Content-Security-Policy">) with a script-src directive, the fraud0 script will be blocked unless the host is allow-listed.

How to check: Open browser DevTools → Network tab → reload the page → inspect the document response headers. If you see a Content-Security-Policy header with a script-src directive that is not * or unsafe-inline-everything, you have one.

Add https://api.fraud0.com to your script-src:

script-src ... https://api.fraud0.com;

If you also have connect-src or img-src directives, allow the same host there:

connect-src ... https://api.fraud0.com;
img-src     ... https://api.fraud0.com;

For more detail on CSP errors, see the FAQ article on Network Status “blocked: CSP”.

1.5 Cookies set by the fraud0 tag

The fraud0 onsite tag sets two first-party cookies. If cookies are unavailable (e.g. blocked by the browser), the tag falls back to localStorage.

Cookie	Purpose	Lifetime
`f0_uid`	Identifies the user across sessions. Format: `{UUID}.{timestamp}`.	365 days
`f0_sid`	Identifies the current session. Expires after 30 minutes of inactivity.	1 day (max)

Both cookies are first-party, same-site, and do not contain personal data beyond a random identifier.

Once you have your cid and know your setup, continue to the next step.

Steps 2–3 — Implement the fraud0 Tag Choose your embed path and implement the Main Tag.