Crossdeck Docs
Dashboard

Crossdeck for Webflow — full setup guide

Setup One-click SDK injection · identity, custom domain, revenue · ~5 min read · Updated August 4, 2026

Everything from install to consent to identity to revenue. Crossdeck ships for Webflow as two deliberately different install paths: the Webflow Marketplace app — a privacy-restricted, consent-first build required by Webflow — and the Direct install, a paste-in snippet you add yourself that unlocks full analytics, automatic identity, and error tracking. This doc walks the Marketplace build end to end (including the consent setup you must complete), then shows how to upgrade to Direct.

TL;DR

Two ways to install — deliberately different

Crossdeck for Webflow is one product with two install contexts, and capability follows who owns the site and its visitors. This is honest by design, not a limitation to work around.

 Marketplace app (Path B)Direct install (Path A)
How you installOne-click from the Webflow Marketplace; OAuth injects the SDK.Paste the @cross-deck/web snippet into your own site (like Framer / GA).
Who’s the customerCrossdeck is a guest on your visitors’ sites.You install on your own site — you’re our customer directly.
CaptureConsent-first. Nothing non-essential fires until the visitor grants it.Full auto-capture: sessions, pageviews, clicks, web-vitals, errors.
IdentityExplicit opt-in only — the “Recognize me” switch. No automatic email reads.Automatic identity at the auth boundary (email → known person).
Error trackingRemoved from this build.Full front-end error capture, stitched to who it hit.
Consent responsibilityTurnkey — Crossdeck Consent supplies the gate; you set your policy URL.Yours — you installed it on your own site and use it lawfully.
Why the Marketplace build is restricted.

Webflow requires a marketplace app to be consent-first and to not read member data automatically — the correct posture for any guest touching someone else’s visitors. The full auto-capture and automatic identity are the reward of the Direct install, never smuggled into the Marketplace build.

The rest of this guide is the Marketplace build. For the Direct install, jump to Upgrade to the Direct install.

Step 1 — Install (two ways)

A. From the Webflow Marketplace (recommended — one click)

  1. Find Crossdeck in the Webflow Marketplace and click Install.
  2. Authorize Crossdeck on your Webflow site.
  3. You land on Crossdeck — sign in, or create a free account if you're new.
  4. Crossdeck provisions a new project and keys for you, injects the SDK, and publishes your site. You land on your dashboard, already live.

B. From the Crossdeck dashboard

  1. In the Crossdeck dashboard, open Developers → Integrations (or the Integrations gallery).
  2. Click Connect on the Webflow card and authorize.
  3. The SDK is injected into the project you're currently in.
The difference between the two.

Installing from Webflow creates a brand-new Crossdeck project for that site. Connecting from the dashboard attaches Webflow to the project you already have open. Same injection either way — both are the consent-first Marketplace build.

Step 2 — Your project is created for you

However you install, your project + web app IDs + publishable key are minted automatically. There's no onboarding wizard, no key to paste. Open the dashboard whenever you like — it's already set up.

The Marketplace build is consent-first: nothing but strictly-necessary runs until a visitor makes a choice. Crossdeck bundles its own consent widget — Crossdeck Consent — into the injected SDK, so the banner is already present on your site. It defers to any consent tool you already run (Webflow's native cookie banner, Cookiebot, OneTrust, GPC, IAB TCF/GPP, Google Consent Mode…) and never shows a second banner. There are three things you set once.

What the Marketplace build captures — four categories

Every category names exactly what it captures and whether it is tied to identity. A visitor grants or refuses each one independently; refusing is as easy as accepting.

CategoryStateWhat it captures
Strictly necessaryLocked onYour site's own essential cookies — sign-in, session, core function. Crossdeck sets nothing here.
AnalyticsOpt-in, default offPage views, sessions, product usage — anonymous by default. A visitor is identified only when they explicitly opt in (below), never automatically.
Recognize me (Identity)Opt-in, default offThis switch is the explicit identity opt-in. On → activity may link to the signed-in person across visits and devices; off → anonymous even when signed in.
MarketingOpt-in, default offReferrer + ad-click IDs (gclid, fbclid, msclkid, ttclid, li_fat_id, twclid) for attribution, and the HubSpot cd_ref arrival ping.
No error tracking, no Trust panel in this build.

The Marketplace build ships exactly those four categories. Front-end error tracking and the Crossdeck Trust panel are not in it — they rely on capabilities a guest app may not use on someone else's visitors. Both are part of the Direct install.

1. Set your privacy-policy URL (required)

Crossdeck Consent is your consent tool — it reflects your policy and your cookies, so it links to a policy you host. In the Crossdeck dashboard, open Integrations → Webflow → Consent and set Privacy-policy URL to a real, public link (e.g. https://yourbrand.com/privacy).

The banner will not render without it.

In Crossdeck-managed mode the widget refuses to initialise without a policy URL — there is no dead # link and no Crossdeck-hosted stand-in. This is deliberate: a consent banner that doesn't link your policy isn't compliant.

2. Add a “Privacy choices” reopen link

After a visitor chooses, the banner disappears — no floating pill. Give them a way back to change or withdraw consent at any time (as easy as granting it). Add this anywhere in your footer or menu in the Webflow Designer — any element carrying the data-crossdeck-consent attribute reopens the widget:

<a href="#" data-crossdeck-consent>Privacy choices</a>

In Webflow: add a Text Link, then Settings → Custom attributes → Add → name data-crossdeck-consent (leave the value empty). Prefer to wire it from your own code? Call:

Crossdeck.consent.open();

3. Choose who owns consent

One setting in Integrations → Webflow → Consent decides whether the Crossdeck banner appears:

What the connector registers for you.

On the Marketplace install you don't paste any script — Crossdeck registers a pinned, integrity-hashed hosted bundle via Webflow's Custom Code API and boots consent mode with the values you set above. For reference (and it's exactly what you'd paste on a manual / Direct install), that call is:

<script
  src="https://unpkg.com/@cross-deck/[email protected]/dist/crossdeck-lite.umd.min.js"
  integrity="sha384-…"
  crossorigin="anonymous"></script>
<script>
  Crossdeck.startConsentMode({
    publicKey: "cd_pub_…",        // client-safe, ingest-only
    appId: "app_…",
    policyUrl: "https://yourbrand.com/privacy",  // YOUR policy
  });
</script>

The consent-mode surface is the standalone @cross-deck/web-lite package — the deliberately privacy-restricted, consent-first build. It never wraps fetch/XHR/history, never scrapes identity from the page, and strips query strings, fragments, and referrers from analytics.

Step 4 — Verify it's working

Open your published site (the *.webflow.io address or your custom domain) and click around. Then open the Crossdeck dashboard → Overview / People — you'll see a live visitor with geo, and the pages they viewed. (Data begins from the first real visit — that first heartbeat also locks your Allowed Origins to that domain.)

Step 5 — Custom domain

When you move to or add a custom domain, add it to your Allowed Origins — 20 seconds:

→ Add a domain to your Allowed Origins

Step 6 — Identity (resolve logged-in members on Webflow Memberships)

Analytics works anonymously out of the box. On the Marketplace build a visitor is recognized only when they turn on Recognize me in the consent widget (their explicit identity opt-in). While that switch is on, the binding below turns anonymous visitors into known people — the Crossdeck cross — using the logged-in member's email. Webflow doesn't expose that to scripts directly, so you bind it once:

  1. In the Webflow Designer, add an element that only renders for logged-in members (e.g. inside a “Logged-in users”-gated container). A plain Div works; set it to hidden (display: none).
  2. Bind that element's text to the member's email: with Memberships on, add a Text inside it and bind it to Current User → Email.
  3. Select the wrapping Div → Settings → Custom attributes → Add → name data-crossdeck-identify-email (leave the value empty).
  4. Publish.

That's it. Crossdeck's loader finds the data-crossdeck-identify-email element, reads the member's email, and calls identify(email) automatically — so signed-in members resolve to known people in Users. On pages with no logged-in member it does nothing (no error).

Why email is the anchor.

Crossdeck keys Webflow identity on email — the member's Webflow user ID is stored in an http-only cookie and can't be read by any script. Email is Crossdeck's join key, so this is the correct anchor. (See How identity works for the full model.)

Step 7 — Revenue (connect a payment rail)

To join revenue to those people:

  1. In the Crossdeck dashboard, open Developers → Rails (Payment rails).
  2. Connect Stripe (or Apple / Google) in one click — Crossdeck never asks for a raw secret key.
  3. If you sell through Webflow Ecommerce / Stripe Checkout, stamp the Crossdeck reference onto the checkout so each payment threads back to the right person. See Rails → Stripe in the dashboard for the exact one-liner.

Once a rail is connected, revenue and entitlements join the same identity graph as your analytics and errors.

Upgrade to the Direct install

The Marketplace app runs in privacy-restricted marketplace mode — consent-first, no automatic identity, no error tracking — because Webflow requires that posture for a guest app touching your visitors. That's the right default for a marketplace install, and it's the same restriction every mature analytics marketplace app ships under. When you want the full product, install Crossdeck directly on your own site, exactly as you would add Google Analytics or a Framer snippet.

The Direct install unlocks:

The Direct install uses the full @cross-deck/web SDK, and consent responsibility is yours — you install it on your own site and use it lawfully (Crossdeck provides the capability; it does not handle your GDPR/ePrivacy obligations for you). Two ways to get it:

  1. Dashboard onboarding — open the Crossdeck dashboard's Onboarding flow, add a Web app, pick your frontend stack, and it generates the paste-in snippet (with your keys already filled in).
  2. Web SDK quickstart — if you'd rather read the steps first, follow the Web SDK quickstart. For a no-build Webflow site, use the CDN <script> path and drop Crossdeck.init(…) into your site-wide custom code (Project settings → Custom code → Head).

Your publishable key is ingest-only

The cd_pub_… key Crossdeck injects is a publishable key: it is client-safe and ingest-only. It exists to do exactly one thing — send events into your project — and it cannot perform any privileged action: it can't read your data back, list customers, change settings, mint other keys, or touch billing. It is designed to sit in public page source, which is why it ships in a browser bundle at all.

Why this is safe.

A publishable key is a write-only front door. Even if someone copies it from your page, the worst they can do is send events — and your Allowed Origins lock rejects those from any domain but yours. Privileged operations require a secret key (cd_sk_…) or workspace key (cd_wk_…), which never leaves your server and is never part of a connector install.

How this differs from the other connectors

Every connector loads the same Crossdeck SDK and feeds the same dashboard — only the install + identity binding differ per platform.

Crossdeck for Webflow — one-click marketplace or dashboard install, auto-provisioned project + keys, SDK injected across every page, custom-domain add via Allowed Origins, Memberships identity via data-crossdeck-identify-email, and revenue on a connected rail (August 4, 2026). Related: Identify users, Connect Stripe.

Using an AI assistant? Read this page as clean markdown — index.md — or the whole docs index at /docs/llms.txt.