Create a script
curl --request POST \
--url https://api.salesive.com/api/v1/scripts \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data @- <<EOF
{
"code": "<script>console.log('hi');</script>",
"enabled": true
}
EOFimport requests
url = "https://api.salesive.com/api/v1/scripts"
payload = {
"code": "<script>console.log('hi');</script>",
"enabled": True
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({code: '<script>console.log(\'hi\');</script>', enabled: true})
};
fetch('https://api.salesive.com/api/v1/scripts', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.salesive.com/api/v1/scripts",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'code' => '<script>console.log(\'hi\');</script>',
'enabled' => true
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.salesive.com/api/v1/scripts"
payload := strings.NewReader("{\n \"code\": \"<script>console.log('hi');</script>\",\n \"enabled\": true\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.salesive.com/api/v1/scripts")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"code\": \"<script>console.log('hi');</script>\",\n \"enabled\": true\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.salesive.com/api/v1/scripts")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"code\": \"<script>console.log('hi');</script>\",\n \"enabled\": true\n}"
response = http.request(request)
puts response.read_body{
"status": 201,
"success": true,
"message": "Script created",
"data": {
"_id": "66e1f0a3c2d4e5f6a7b8c9d0",
"integration": null,
"code": "<script>console.log('hi');</script>",
"enabled": true,
"shop": "6680aabbccddeeff00112200",
"createdAt": "2026-06-21T10:30:00.000Z",
"updatedAt": "2026-06-21T10:30:00.000Z"
}
}{
"status": 401,
"success": false,
"message": "Authentication required",
"data": null
}{
"status": 403,
"success": false,
"message": "Insufficient scope",
"data": null
}Scripts
Create a script
Create a storefront script owned by your installation. Requires the WRITE_SCRIPTS scope.
POST
/
scripts
Create a script
curl --request POST \
--url https://api.salesive.com/api/v1/scripts \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data @- <<EOF
{
"code": "<script>console.log('hi');</script>",
"enabled": true
}
EOFimport requests
url = "https://api.salesive.com/api/v1/scripts"
payload = {
"code": "<script>console.log('hi');</script>",
"enabled": True
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({code: '<script>console.log(\'hi\');</script>', enabled: true})
};
fetch('https://api.salesive.com/api/v1/scripts', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.salesive.com/api/v1/scripts",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'code' => '<script>console.log(\'hi\');</script>',
'enabled' => true
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.salesive.com/api/v1/scripts"
payload := strings.NewReader("{\n \"code\": \"<script>console.log('hi');</script>\",\n \"enabled\": true\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.salesive.com/api/v1/scripts")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"code\": \"<script>console.log('hi');</script>\",\n \"enabled\": true\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.salesive.com/api/v1/scripts")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"code\": \"<script>console.log('hi');</script>\",\n \"enabled\": true\n}"
response = http.request(request)
puts response.read_body{
"status": 201,
"success": true,
"message": "Script created",
"data": {
"_id": "66e1f0a3c2d4e5f6a7b8c9d0",
"integration": null,
"code": "<script>console.log('hi');</script>",
"enabled": true,
"shop": "6680aabbccddeeff00112200",
"createdAt": "2026-06-21T10:30:00.000Z",
"updatedAt": "2026-06-21T10:30:00.000Z"
}
}{
"status": 401,
"success": false,
"message": "Authentication required",
"data": null
}{
"status": 403,
"success": false,
"message": "Insufficient scope",
"data": null
}Creates a script owned by your installation. The store is bound to your app token server-side, so never send a shop id.
If you send
The integration field
integration is optional for app tokens. An app script belongs to the installation, not to a merchant catalog integration, so you can leave the field out:
{ "code": "<script src=\"https://cdn.example.com/pixel.js\" async></script>", "enabled": true }
integration, it must name your own app. Any of these values is accepted and not stored, because the installation already records the owner:
- your app id, from
GET /app/contextatdata.app.id. It is also the id in the developer console URL,/apps/developer/<id>. - your client id,
app_<hex> - your installation id, from
GET /app/contextatdata.app.installationId
400 with Unknown script integration. A merchant session gets the same message when the id is not a catalog script integration.
Before you create
CallGET /scripts, or GET /scripts/integration/<your app id>, before creating anything. An app sees only its own scripts, so this read back tells you whether a previous install already created one and avoids duplicates on reinstall. Both return data as an array.
Prefer an app embed when you can
If the script only needs to load on every page, declare an app embed instead of writing through this API. See Storefront extensions: the platform injects the script at install and you make no runtime call. Use the scripts API when the code must be created, changed or switched per store at runtime.Uninstall
Uninstalling switches your running scripts off and remembers which ones were on. If the merchant reinstalls and grantsWRITE_SCRIPTS again, those scripts come back on. Check GET /scripts after an install before creating a new one.Authorizations
Installed-app access token (prefix app_), issued by the OAuth install flow. The store is bound to the token server-side — never send a shop id.
Body
application/json
Optional for app tokens. Your own app id (from GET /app/context, data.app.id), your client id or your installation id. The value is accepted and not stored, because an app script belongs to the installation. A merchant session must send a catalog script integration instead.
The script/tracking code to inject into the storefront.
Whether the script is active.
Response
The created script.
Standard Salesive response envelope. The operation-specific payload is carried in data.
Was this page helpful?

