GenerateSaaSIntegrations
Wire third-party analytics, support chat, and affiliate trackers in @repo/config behind a GDPR-aware cookie banner.
Third-party services are configured in @repo/config (packages/config/src/index.ts) and rendered client-side (analytics additionally feeds a small server seam for webhook-driven events). Each provider turns on by the presence of its config sub-key; only consent-required scripts wait for the banner.
Cookie consent
config.cookieBanner tri-state gate (true / false / "auto") that holds consent-required scripts.Analytics
config.analytics across two tiers - consent-required (Google, PostHog) and privacy-focused (Umami, Plausible, and more).AI-driven analytics review
Support chat
config.support live-chat widget, wired to Crisp and Chatwoot; off until you set a provider sub-key.Affiliate tracking
config.affiliate referral pixels - Refgrow, Affonso, PromoteKit - off until you add a sub-key.Consent vs. surfacing
Two distinct behaviors - do not conflate them. A provider can surface the banner (because it drops cookies) yet still load its script regardless of the visitor's choice. Only Google and PostHog actually wait for consent.
| Integration | Config key | Drops cookies | Surfaces banner | Waits for consent |
|---|---|---|---|---|
| Google Analytics | config.analytics.google | Yes | Yes | Yes |
| PostHog | config.analytics.posthog | Yes | Yes | Yes |
| Privacy-focused analytics | config.analytics.{umami,plausible,openpanel,datafast,ahrefs,vercel} | No | No | No |
| Crisp chat | config.support.crisp | Yes | Yes | No - loads anyway |
| Chatwoot chat | config.support.chatwoot | Yes | Yes | No - loads anyway |
| Affiliate trackers | config.affiliate.{refgrow,affonso,promotekit} | Yes | Yes | No - pixels load anyway |
- Under the default
cookieBanner: "auto", the banner appears only when a surfacing provider is enabled and the visitor must consent (isGdprCountryfrom@repo/utils/helpers, which fails safe totruewhen geo is unknown). - Out of the box no surfacing provider is enabled, so the banner stays hidden until you turn one on.
- Declining persists as a tri-state
acceptedCookiescookie:"false"keeps Google and PostHog off, while support chat and affiliate pixels still load.
Local development
Each group has its own enableInDev flag - config.analytics.enableInDev, config.support.enableInDev, config.affiliate.enableInDev - all defaulting to false, so nothing loads locally. The flag also gates the "auto" banner: a provider counts toward the trigger only when its script would actually load.
All analytics and affiliate keys are public (publishable) and ship to the browser. Never paste a secret API key into config.
Connection scope
Where an AI integration connection lives - the project, organization and user levels, the flags that offer each, how visibility unions, and the allowedScopes narrowing.
Cookie consent
Gate cookie-dropping analytics, chat, and affiliate scripts behind a GDPR consent banner with config.cookieBanner and config.consentPolicy.