Auth: Authorization: Bearer <access_token> (the OAuth token your app received at install) or X-Agent-Key: sq_agt_*. Scopes: read_script_tags, write_script_tags. A script tag is a remote <script src> loaded asynchronously on every page of the store’s online store. Register a URL and the store loads it. You don’t need to republish or edit the theme.

​
Endpoints

  • POST /script_tags: register a script. 201 when it is new, 200 with the existing tag when your app already registered that src.
  • GET /script_tags?since_id=&src=&limit=: list your tags, id ascending. limit is 1–250 and defaults to 50.
  • GET /script_tags/count · GET /script_tags/{id}
  • PUT /script_tags/{id}: change the src. { "script_tag": { "src": "https://…" } }
  • DELETE /script_tags/{id}
Response shape: { "success": true, "data": { "script_tag": { "id", "src", "event", "display_scope", "cache", "created_at", "updated_at" } } }.

​
Rules

  • src must be an absolute https:// URL of at most 2048 characters, with no credentials. The storefront is served over HTTPS, so an http:// script would be blocked as mixed content.
  • event is onload and display_scope is online_store. Order-status-page scripts are not supported, matching Shopify’s move of checkout customisation to extensions.
  • Each app can register up to 50 tags per store. Your app only sees and changes its own tags. The merchant can see and remove every tag on their store.
  • Timing: a new or deleted tag reaches live pages within about 5 minutes (the storefront config cache). Nothing is baked into the theme.
  • Uninstall: when the merchant uninstalls your app, its tags stop loading immediately and are deleted. They also stop loading while an install is waiting for the merchant to re-approve scopes.
  • The script is loaded with async and gets data-dtc-script-tag on its element. Read the store with document.currentScript or your own query string, e.g. ?shop=<store_id>.