@redacto.io/consent-sdk-react-native 5.1.0 → 6.0.0

package/README.md

@@ -85,6 +85,7 @@ Pass the sandbox `token`, org/workspace, and a test identity (`email`, `mobile`,
 import { RedactoNoticeConsent } from "@redacto.io/consent-sdk-react-native";
 
 <RedactoNoticeConsent
+  baseUrl={BASE_URL} // the API host, e.g. https://api.redacto.io
   noticeId={NOTICE_UUID}
   token={SANDBOX_TOKEN}
   organisationUuid={ORG_UUID}
@@ -104,7 +105,6 @@ import { RedactoPrivacyCenter } from "@redacto.io/consent-sdk-react-native/priva
 
 <RedactoPrivacyCenter
   baseUrl={BASE_URL}
-  slug="acme-co"
   token={SANDBOX_TOKEN}
   organisationUuid={ORG_UUID}
   workspaceUuid={WORKSPACE_UUID}
@@ -131,7 +131,7 @@ Both `RedactoNoticeConsent` and `RedactoPrivacyCenter` accept the same sandbox p
 
 - The SDK sends the sandbox token as an `X-Consent-Token` header and the test identity inside each request (query params on reads, body on writes) — no JWT decode, no token refresh (a `401` fails fast).
 - The server records everything under `environment=test`, namespaced so sandbox data never mixes with — or reads — your live records.
-- Sandbox always talks to the consent server; it never routes to the Go ledger.
+- With the API host as `baseUrl`, sandbox requests go to the same services as live ones (see [`baseUrl` and service routing](#baseurl-and-service-routing)). With the deprecated consent server URL and no `ledgerBaseUrl`, sandbox talks to the consent server only.
 
 ### Going live
 
@@ -143,10 +143,10 @@ Sandbox and production use the same components. To ship, remove the sandbox prop
 
 The SDK never talks to Redacto with your CMS API key directly — your backend acts as a token broker. Obtain your **CMS-API-Key** from the Redacto Dashboard, store it in your backend's environment, and expose two endpoints to your mobile app:
 
-1. **Generate access token** — `POST /public/organisations/{org_uuid}/workspaces/{workspace_uuid}/tokens/generate`
-2. **Refresh access token** — `POST /consent/public/organisations/{org_uuid}/workspaces/{workspace_uuid}/tokens/refresh`
+1. **Generate access token** — `POST {consent server}/public/organisations/{org_uuid}/workspaces/{workspace_uuid}/tokens/generate`
+2. **Refresh access token** — `POST {consent server}/public/organisations/{org_uuid}/workspaces/{workspace_uuid}/tokens/refresh`
 
-Both endpoints expect the `X-CMS-API-Key` header. Example (Express):
+The consent server is `{API host}/consent`, e.g. `https://api.redacto.io/consent`: the backend calls it directly, so it takes the consent server URL even though the SDK takes the API host. Both endpoints expect the `X-CMS-API-Key` header. Example (Express), where `base_url` is the consent server URL:
 
 ```ts
 import express from "express";
@@ -174,7 +174,7 @@ app.post("/api/consent/refresh-token", async (req, res) => {
   const { refresh_token, organisation_uuid, workspace_uuid, base_url } = req.body;
 
   const response = await axios.post(
-    `${base_url}/consent/public/organisations/${organisation_uuid}/workspaces/${workspace_uuid}/tokens/refresh`,
+    `${base_url}/public/organisations/${organisation_uuid}/workspaces/${workspace_uuid}/tokens/refresh`,
     { refresh_token },
     { headers: { "X-CMS-API-Key": CMS_API_KEY } }
   );
@@ -195,6 +195,7 @@ Modal consent component. Supports initial consent, reconsent, age verification,
 import { RedactoNoticeConsent } from "@redacto.io/consent-sdk-react-native";
 
 <RedactoNoticeConsent
+  baseUrl="https://api.redacto.io"
   noticeId="your-notice-uuid"
   accessToken={accessToken}
   refreshToken={refreshToken}
@@ -210,19 +211,49 @@ import { RedactoNoticeConsent } from "@redacto.io/consent-sdk-react-native";
 | `noticeId`                  | `string`                      | ✓        | UUID of the consent notice                               |
 | `accessToken`               | `string`                      | ✓        | JWT access token                                         |
 | `refreshToken`              | `string`                      | ✓        | JWT refresh token                                        |
-| `baseUrl`                   | `string`                      |          | Override API base URL                                    |
-| `ledgerBaseUrl`             | `string`                      |          | Go ledger base URL. When set, consent writes and prior-consent checks route through the ledger (falls back: ledger → baseUrl → default). Omit to keep the legacy consent-server path. |
-| `settings`                  | `Partial<Settings>`           |          | UI customisation (colours, border radius, fonts)         |
+| `baseUrl`                   | `string`                      |          | API host, e.g. `https://api.redacto.io` (recommended). The consent server URL (`…/consent`) still works but is deprecated. Defaults to `https://api.redacto.io/consent`. See [`baseUrl` and service routing](#baseurl-and-service-routing) |
+| `ledgerBaseUrl`             | `string`                      |          | **Deprecated.** Read only when `baseUrl` is the consent server URL (`…/consent`) or omitted, as in earlier releases: it then routes consent writes and already-consented checks through the ledger. Ignored when `baseUrl` is the API host |
+| `settings`                  | `Partial<Settings>`           |          | Overrides for the appearance set in the Redacto console, key by key (see [Appearance](#appearance)) |
 | `language`                  | `string`                      |          | Initial language code (e.g. `"en"`)                      |
 | `blockUI`                   | `boolean`                     |          | Block the modal from being dismissed                     |
 | `applicationId`             | `string`                      |          | Application-specific UUID                                |
 | `validateAgainst`           | `"all" \| "required"`         |          | Validation mode                                          |
 | `includeFullyConsentedData` | `boolean`                     |          | Include already-consented items (review mode)            |
-| `reviewModeButtonText`      | `string`                      |          | CTA text in review mode                                  |
+| `reviewModeButtonText`      | `string`                      |          | With `includeFullyConsentedData`, the button shown when everything is already consented; it calls `onAccept`. Default `"Continue"` |
 | `onAccept`                  | `() => void`                  | ✓        | Called on successful consent                             |
 | `onDecline`                 | `() => void`                  | ✓        | Called when user declines                                |
 | `onError`                   | `(error: Error) => void`      |          | Called on API errors                                     |
 
+#### Appearance
+
+The notice renders the appearance configured in the Redacto console (`active_config.appearance`): style (`classic`, `glass`, `minimal`, `soft`), layout (centred modal or bottom sheet on phones; centre, corner or bottom bar on wider screens), palette and dark palette, corner radius, logo size and position, selection control (checkbox, radio or dropdown, on purposes, product headings and data elements; checkboxes can be drawn as switches), text scale, motion, collapsible sections and an optional "are you sure" step before submitting. The frame around the admin's copy (yes/no, the confirm step, the verification panel, hints and labels) is shown in the notice's language. With nothing configured it looks as it did before.
+
+Every `settings` key overrides the console key by key:
+
+| Key | Type | Description |
+| --- | --- | --- |
+| `theme` | `"classic" \| "glass" \| "minimal" \| "soft"` | Visual style |
+| `selectionControl` | `"checkbox" \| "radio" \| "dropdown"` | Control on purposes, product headings and data elements |
+| `controlStyle` | `"checkbox" \| "switch"` | How checkbox rows are drawn, in any style |
+| `confirmBeforeSubmit` | `boolean` | Ask "are you sure" before Accept All, Accept Selected or Decline submits |
+| `mobileLayout` | `"modal" \| "sheet"` | Phones: centred or docked to the bottom edge |
+| `desktopPosition` | `"center" \| "bottom-right" \| "bottom-left" \| "bottom-bar"` | Wider screens |
+| `backdrop` | `"dim" \| "none"` | Dim the screen behind the notice |
+| `collapsibleSections` | `boolean` | Collapse the notice text and DPO block into disclosures |
+| `phoneFooter` | `"stacked" \| "paired"` | Phone button layout |
+| `autoDark`, `darkPalette` | `boolean`, palette | Follow the device's dark mode (`useColorScheme`) with this palette |
+| `backgroundColor`, `surfaceColor`, `headingColor`, `textColor`, `mutedTextColor`, `borderColor`, `overlayColor`, `link` | `string` | Palette |
+| `button.accept`, `button.acceptAll`, `button.acceptSelected`, `button.decline`, `button.language` | colours | Button colours |
+| `toggle`, `ttsHighlight` | colours | Switch colours; the element being read aloud |
+| `borderRadius`, `maxWidth`, `logoSize` | `string \| number` | Corner radius, wide-screen width, logo height, in px |
+| `textScale` | `"sm" \| "md" \| "lg"` | Scales every text size |
+| `motion` | `boolean` | `false` turns entrances and transitions off (they are also off while the device asks for reduced motion) |
+| `font` | `string` | Font family, winning over the console's |
+
+React Native has no blur, so `glass` draws a denser tinted surface instead of a frosted one. `customCss` is accepted for parity with the web SDK and ignored. A phone sheet, a corner card and a bottom bar size to their content, up to 92% (sheet) or 70% of the screen.
+
+The language selector names each language in its own script ("हिन्दी (Hindi)"). If the notice fails to load, it stays on screen with the reason and a **Refresh** button (closing it counts as a decline), and `onError` is still called. With `includeFullyConsentedData`, a visitor who has already consented to everything sees a single **Continue** button (`reviewModeButtonText`) that calls `onAccept`.
+
 ### `RedactoNoticeConsentInline`
 
 Inline consent component. Auto-submits when all required elements are checked and an access token is available.
@@ -231,6 +262,7 @@ Inline consent component. Auto-submits when all required elements are checked an
 import { RedactoNoticeConsentInline } from "@redacto.io/consent-sdk-react-native";
 
 <RedactoNoticeConsentInline
+  baseUrl="https://api.redacto.io"
   org_uuid="org-uuid"
   workspace_uuid="workspace-uuid"
   notice_uuid="notice-uuid"
@@ -248,16 +280,20 @@ import { RedactoNoticeConsentInline } from "@redacto.io/consent-sdk-react-native
 | `workspace_uuid`     | `string`                     | ✓        | Workspace UUID                                    |
 | `notice_uuid`        | `string`                     | ✓        | Notice UUID                                       |
 | `accessToken`        | `string`                     |          | JWT access token (triggers auto-submit when set)  |
-| `baseUrl`            | `string`                     |          | Override API base URL                             |
-| `ledgerBaseUrl`      | `string`                     |          | Go ledger base URL. When set, consent writes and already-consented checks route through the ledger. Omit for legacy behavior. |
+| `baseUrl`            | `string`                     |          | API host, e.g. `https://api.redacto.io` (recommended). The consent server URL (`…/consent`) still works but is deprecated. Defaults to `https://api.redacto.io/consent`. See [`baseUrl` and service routing](#baseurl-and-service-routing) |
+| `ledgerBaseUrl`      | `string`                     |          | **Deprecated.** Read only when `baseUrl` is the consent server URL (`…/consent`) or omitted, as in earlier releases: it then routes consent writes and already-consented checks through the ledger. Ignored when `baseUrl` is the API host |
 | `language`           | `string`                     |          | Language code                                     |
-| `settings`           | `Partial<Settings>`          |          | UI customisation                                  |
+| `settings`           | `Partial<Settings>`          |          | Overrides for the console appearance (palette, text scale, selection control, `confirmBeforeSubmit`, …), as on `RedactoNoticeConsent` |
 | `applicationId`      | `string`                     |          | Application-specific UUID                         |
 | `onAccept`           | `() => void`                 |          | Called on successful consent                      |
 | `onDecline`          | `() => void`                 |          | Called when user declines                         |
 | `onError`            | `(error: Error) => void`     |          | Called on errors                                  |
 | `onValidationChange` | `(isValid: boolean) => void` |          | Fires when validation state changes               |
 
+The inline notice follows the console appearance too, and starts from the notice's pre-selection (`purpose_preselection`: nothing ticked, the required elements, or everything), so it can auto-submit on first paint when that satisfies the required elements and a token is present. With "confirm before submit" set, it asks before the auto-submit and records nothing if the visitor says no.
+
+`RedactoNoticeAssisted` (operator-assisted capture) displays the console appearance as well and takes the same `settings` prop; what it submits is unchanged.
+
 ## TTS Audio
 
 If `expo-audio` is installed, the consent notice will dynamically load it and enable text-to-speech playback. The SDK calls `setAudioModeAsync` and creates an audio player internally — you don't need to set anything up beyond installing the package. See the [expo-audio docs](https://docs.expo.dev/versions/latest/sdk/audio/) if you need to customise audio session behaviour app-wide.
@@ -277,7 +313,6 @@ import { RedactoPrivacyCenter } from "@redacto.io/consent-sdk-react-native/priva
 
 <RedactoPrivacyCenter
   baseUrl={BASE_URL}
-  slug="acme-co"
   accessToken={accessToken}
   refreshToken={refreshToken}
   theme="light"
@@ -293,15 +328,67 @@ import { RedactoPrivacyCenter } from "@redacto.io/consent-sdk-react-native/priva
 
 | Prop           | Type                                                                          | Required | Default              | Description                              |
 | -------------- | ----------------------------------------------------------------------------- | -------- | -------------------- | ---------------------------------------- |
-| `baseUrl`      | `string`                                                                      | ✓        | -                    | Consent server base URL                  |
-| `ledgerBaseUrl` | `string`                                                                     |          | -                    | Go ledger base URL. When set, user consents, group purposes, receipts, and manage-consent route through the ledger. Omit to use the legacy `/dsar/privacy-center/*` routes. See the note below on the DSAR form picker. |
-| `slug`         | `string`                                                                      | ✓        | -                    | Workspace slug                           |
+| `baseUrl`      | `string`                                                                      | ✓        | -                    | API host, e.g. `https://api.redacto.io` (recommended). The consent server URL (`…/consent`) still works but is deprecated. See [`baseUrl` and service routing](#baseurl-and-service-routing) |
+| `ledgerBaseUrl` | `string`                                                                     |          | -                    | **Deprecated.** Read only when `baseUrl` is the consent server URL (`…/consent`), as in earlier releases: it then routes user consents, group purposes, receipts and manage-consent through the ledger; without it, the legacy `/dsar/privacy-center/*` routes are used. Ignored when `baseUrl` is the API host. See the note below on the DSAR form picker. |
+| `slug`         | `string`                                                                      |          | -                    | **Deprecated** and ignored, to be removed in a future major release; passing it logs a one-time console warning. The organisation, and its branding, come from the access token, or from `organisationUuid` and `workspaceUuid` |
 | `accessToken`  | `string`                                                                      | ✓        | -                    | JWT access token                         |
 | `refreshToken` | `string`                                                                      | ✓        | -                    | JWT refresh token                        |
 | `onError`      | `(error: Error) => boolean`                                                   | ✓        | -                    | Error handler; return `true` if handled  |
 | `theme`        | `"light" \| "dark"`                                                           |          | `"light"`            | Theme variant                            |
 | `initialPage`  | `"consent-manager" \| "form" \| "activity" \| "receipts" \| "case-details"`   |          | `"consent-manager"` | Page to render first                     |
 | `onBack`       | `"back" \| "signout"`                                                         |          | -                    | Navbar back / signout control behaviour  |
+| `organisationUuid` / `workspaceUuid` | `string`                                                |          | -                    | Without a token, address the built-in sign-in and the published settings |
+| `settings`     | `PrivacyCenterSettings`                                                       |          | -                    | Overrides for the settings published in the console, merged field by field per group |
+| `builtInSignIn` | `boolean`                                                                    |          | `false`              | With no token, show the built-in OTP sign-in instead of the loader |
+| `onReady`      | `(event: { signedIn: boolean }) => void`                                      |          | -                    | Called once, when the first screen (sign-in or the Privacy Center) is on show |
+| `onConsentChange` | `(change: PrivacyCenterConsentChange) => void`                             |          | -                    | After a consent was withdrawn, re-granted or renewed |
+| `onRequestSubmit` | `(request: PrivacyCenterRequestSubmission) => void`                        |          | -                    | After a data request (case) was created |
+| `onSignOut`    | `(event: { reason: "user" \| "timeout" \| "session-expired" }) => void`        |          | -                    | When the visitor is signed out, with the reason |
+
+#### Published settings
+
+`RedactoPrivacyCenter` fetches the settings published in the Redacto console (Privacy Center › Settings) once it knows the organisation (from the props, the token's claims or an earlier session), and again in each language the visitor switches to. It never waits for them: it renders with the defaults, which reproduce the Privacy Center as it was, and keeps them if the request fails. Responses are cached per organisation and language for five minutes.
+
+What the settings drive:
+
+- **Branding**: display name, logo and logo height, primary and accent colours, font (resolved through the shared font catalogue, as the notice does) and corner radius. Each inherits workspace branding until the console says otherwise.
+- **Menu**: section order, labels and on/off. A switched-off section leaves the home screen and menu and can't be navigated to; switching off notifications removes the bell.
+- **Welcome message** on the home screen, with `{brand}`, `{legal}`, `{year}`, `{name}` and `{contact}` filled in.
+- **Requests**: the request types offered (order, labels, on/off, narrowed to what the server allows), the grievance categories, and whether an erasure also revokes consent (asked of the data principal unless the organisation decided).
+- **Withdraw warning**: the organisation's default; a purpose's own warning still wins.
+- **Languages**: the languages the switcher offers, and the one a visitor lands on.
+- **Inactivity sign-out**: with `portal.session_timeout_minutes`, the visitor is signed out after that long without a touch, scroll or keystroke (including on return from the background past the deadline) and lands on the session-expired screen.
+- **Footer**: links, privacy policy, grievance officer and Data Protection Board lines, copyright, and "Powered by".
+- **Sign-in screen** (see below).
+
+Urdu, Sindhi and Kashmiri lay out right to left once settings are published or overridden, using `direction` and `writingDirection` on the Privacy Center's own views: the app's `I18nManager` is never touched.
+
+The `settings` prop takes overrides merged over each published group, so one value can change while the rest of what the console published stays; `settings.theme` is kept as an alias for `branding.style`. React Native has one Privacy Center look, so the style is read but changes nothing; custom CSS, the SEO page title and embed origins are web-only and not applied.
+
+```tsx
+<RedactoPrivacyCenter
+  baseUrl={BASE_URL}
+  accessToken={accessToken}
+  refreshToken={refreshToken}
+  onError={() => false}
+  settings={{ portal: { welcome_enabled: true, welcome_title: "Hello from {brand}" } }}
+/>
+```
+
+#### Built-in sign-in
+
+With `builtInSignIn` and no token, the Privacy Center shows its own sign-in: the visitor gives a mobile number or email, receives a one-time code (resend after 50 seconds) and is signed straight in with the tokens it issues. Layout (`card`, `split` or `minimal`), background, copy, channels, default country code, notice line and support link come from the published `sign_in` settings; copy left at its default is shown in the visitor's language. The organisation and workspace come from `organisationUuid` / `workspaceUuid` or an earlier sign-in's session, never from `slug`; without them the sign-in says the organisation could not be loaded. When the session expires and the host gave no `onBack`, the session-expired screen offers signing in again. Without `builtInSignIn` the Privacy Center keeps its loader until the host passes a token, as before.
+
+#### Lifecycle callbacks
+
+`onReady`, `onConsentChange`, `onRequestSubmit` and `onSignOut` always call the latest handler passed, and a handler that throws is logged, never rethrown.
+
+| Callback | Payload |
+| --- | --- |
+| `onReady` | `{ signedIn }` — false when the sign-in screen is what shows |
+| `onConsentChange` | `{ action: "revoke" \| "regrant" \| "renew", purposeUuid, productUuid, dataElementUuids, nominatorUuid }` |
+| `onRequestSubmit` | `{ caseId, caseUuid, requestType, productUuid }` |
+| `onSignOut` | `{ reason: "user" \| "timeout" \| "session-expired" }` |
 
 ### Composable Components
 
@@ -319,7 +406,7 @@ If you want to compose your own shell, import the screen-level building blocks i
 | `BottomTabBar`     | Bottom tab navigation                                  |
 | `Footer`           | Footer block                                           |
 
-These rely on the context providers (`AuthProvider`, `BaseUrlProvider`, `NavigationProvider`, `ThemeProvider`, and `QueryClientProvider` for React Query hooks) — wrap them yourself if you compose the pages directly.
+These rely on the context providers (`AuthProvider`, `BaseUrlProvider`, `NavigationProvider`, `ThemeProvider`, and `QueryClientProvider` for React Query hooks) — wrap them yourself if you compose the pages directly. Pass `ThemeProvider` the `organisationUuid` to brand a composition: it ignores `slug`.
 
 ### Receipt downloads
 
@@ -339,11 +426,11 @@ For building custom screens that match Privacy Center styling, the package expor
 
 For consumers who want fully custom UI, the headless core exposes the API client, orchestration helpers, hooks, and auth utilities:
 
-- **API client**: `createConsentClient`
+- **API client**: `createConsentClient(baseUrl, ledgerBaseUrl?)`, which takes `baseUrl` the same way as the components
 - **Orchestration helpers** (handle auth retry / token refresh internally): `getFormData`, `createCaseRequest`, `fetchProducts`, `fetchUserConsents`, `manageConsent`, `fetchActivities`, `fetchCaseHistory`, `getCaseMessages`, `sendCaseMessage`, `uploadCaseDocument`, `submitDocumentForRequest`, `createOtp`, `verifyOtp`, `exchangeToken`
 - **Auth utilities**: `decodeJwtToken`, `isJwtExpired`, `ensureValidToken`, `signOutPrivacyCenter`, `compareEmails`, `getActivityTypeStatus`, `formatActivityType`
 - **React Query hooks**: `useCaseHistory`, `useCaseMessages`
-- **Context providers**: `AuthProvider` + `useAuth`, `BaseUrlProvider` + `useBaseUrl`, `NavigationProvider` + `useInternalNavigation`, `ThemeProvider` + `useTheme`
+- **Context providers**: `AuthProvider` + `useAuth`, `BaseUrlProvider` + `useBaseUrl`, `NavigationProvider` + `useInternalNavigation`, `ThemeProvider` + `useTheme`. Given the API host, `useBaseUrl()` returns the derived consent server URL as `baseUrl` and the derived ledger URL as `ledgerBaseUrl`
 - **Types**: `Workspace`, `OrganizationDetail`, `DataElement`, `Purpose`, `UserConsent`, `Activity`, `CaseHistoryDetail`, `CaseMessage`, `MessageDocument`, `RequestTypeEnum`, `GrievanceTypeEnum`, `ConsentStatusEnum`, and more (see `privacy-center.ts` for the full export list)
 
 ## Configuration and Env Best Practices
@@ -351,19 +438,52 @@ For consumers who want fully custom UI, the headless core exposes the API client
 - The SDK is runtime-configured via props and does not read from `.env` directly.
 - Keep API keys and server secrets on your backend only.
 - In Expo apps, values read from `EXPO_PUBLIC_*` are bundled into the app and should only contain non-sensitive config like UUIDs and URLs.
-- If you do not pass `baseUrl`, the SDK defaults to `https://api.redacto.io/consent` for both notice and Privacy Center surfaces.
-- `ledgerBaseUrl` is optional and independent of `baseUrl` — pass both when routing consent through the Go ledger. Omitting it keeps the legacy consent-server behavior.
+- Pass the API host of your environment as `baseUrl`, e.g. `https://api.redacto.io`. If the notice components get no `baseUrl`, they fall back to the built-in production default, `https://api.redacto.io/consent`, and log a one-time warning.
+
+## `baseUrl` and service routing
+
+Pass the Redacto **API host** as `baseUrl`, for example `https://api.redacto.io`. The SDK derives each service from it — the consent server at `{baseUrl}/consent`, the consent ledger at `{baseUrl}/consent-ledger` and the user service at `{baseUrl}/user/api/0` — and sends each request to the service that serves it:
+
+- **Notice components** — consent writes (`submit-consent`) and the already-consented check (`check-consent`) go to the ledger. `RedactoNoticeConsent` reads the notice from the ledger in a JWT session, and from the consent server in the magic-link (`applicationId`) flow and in sandbox; its audio comes from the ledger, sandbox included. `RedactoNoticeConsentInline` reads the notice from the ledger when it has an `accessToken`, and from the consent server without one and in the magic-link flow. `RedactoNoticeAssisted`'s notice, OTP and audio, and guardian verification, go to the consent server.
+- **Privacy Center** — user consents, group purposes, receipts (including the `/download` PDF path) and manage-consent (sent as a `partial: true` write) go to the ledger. DSAR form, cases, activities, OTP, token exchange, notifications and uploads go to the consent server; org branding comes from the user service.
+
+A host behind a path prefix works the same way: `https://gateway.example.com/redacto` gives `https://gateway.example.com/redacto/consent` and so on. A trailing `/` is ignored, and a `baseUrl` ending in `/consent-ledger` resolves to its host.
 
-## Ledger mode
+If the already-consented check fails, the component carries on and submits as usual.
 
-Passing `ledgerBaseUrl` routes consent-bearing reads and writes to the Go ledger:
+> **Known limitation.** Unlike the React SDK, the DSAR form's product picker is **not** overlaid from ledger-served consents. Against a workspace cut over to the ledger — where the legacy `form/data` response carries no product groups — the picker renders empty. If your DSAR form depends on the product picker, use the deprecated consent server URL as `baseUrl` without `ledgerBaseUrl` until this is addressed.
 
-- **Notice components** — `submit-consent` goes to the ledger, and the already-consented check uses the ledger's `check-consent` endpoint instead of the legacy HTTP 409 signal. Notice content, tokens, and TTS always stay on `baseUrl`.
-- **Privacy Center** — user consents, group purposes, receipts (including the `/download` PDF path), and manage-consent (sent as a `partial: true` write) route to the ledger. DSAR form, cases, activities, OTP, and notifications stay on `baseUrl`.
+### Deprecated: the consent server URL and `ledgerBaseUrl`
+
+Earlier releases took the consent server URL as `baseUrl` (`https://api.redacto.io/consent`) and the Go ledger as a separate `ledgerBaseUrl`. Both keep working exactly as before:
+
+- A `baseUrl` ending in `/consent` is the consent server URL, and `ledgerBaseUrl`, when passed, the ledger. Requests route as in earlier releases: with `ledgerBaseUrl`, as above, except that the inline notice read and sandbox audio stay on the consent server; without it, everything goes to the consent server, on its legacy routes (`/dsar/privacy-center/*`, `manage-consent?status=`, receipts `/pdf`, and the HTTP 409 already-consented signal).
+- With the API host as `baseUrl`, `ledgerBaseUrl` is ignored: the ledger is always `{baseUrl}/consent-ledger`, and the SDK logs a one-time warning asking you to remove it.
+
+The SDK logs a one-time console warning when `baseUrl` is left out, when it ends in `/consent`, and when `ledgerBaseUrl` is passed. These forms will be removed in a future major release: pass the API host as `baseUrl` and drop `ledgerBaseUrl`.
+
+### Your backend
+
+Your token backend calls the consent server itself, so it still needs the consent server URL, `{API host}/consent` (see [Backend Server Setup](#backend-server-setup)). If your app passes one value to both, give the SDK the API host and send `${BASE_URL}/consent` to the backend.
+
+### Local development
+
+Put the services behind one local gateway, the way production does, and pass its address as `baseUrl`. For example, with [Caddy](https://caddyserver.com), the consent server on port 8000 and the ledger on port 8090:
+
+```caddyfile
+:8080 {
+	handle /consent-ledger/* {
+		reverse_proxy localhost:8090
+	}
+	handle /consent/* {
+		reverse_proxy localhost:8000
+	}
+}
+```
 
-Every ledger read degrades to the legacy path on failure, so a ledger outage does not break the consent flow.
+Then pass `baseUrl="http://localhost:8080"`. Both services serve their own path prefix (`/consent/…`, `/consent-ledger/…`), so the gateway forwards paths unchanged. Any reverse proxy works the same way (nginx, Traefik, your docker-compose gateway).
 
-> **Known limitation.** Unlike the React SDK, the DSAR form's product picker is **not** overlaid from ledger-served consents. Against a workspace cut over to the ledger — where the legacy `form/data` response carries no product groups — the picker renders empty. If your DSAR form depends on the product picker, stay on the legacy path until this is addressed.
+On the Android emulator the host machine is `http://10.0.2.2:8080`; the iOS simulator reaches it at `http://localhost:8080`. A physical device needs the machine's LAN IP.
 
 ## License