Shopify script tag debug

TLDR: if you click "Check out" on Shopify and land on the default Shopify checkout instead of your WooshPayment one, the issue is almost always one of these: 1) script not loaded, 2) live theme not exposing an interceptable pattern, 3) theme CDN cache, 4) restrictive CSP. ScriptTag is Shopify's legacy path: before sending traffic, always validate it with a real cart test on the published theme.

Diagnostics before traffic

Open your store, add a product to the cart, then DevTools (F12).

Check 1 — is the script loaded?

DevTools → Network → filter by wooshpayment. Reload the cart page. You should see:

checkout-interceptor.js   200   api.wooshpayment.com   ~3 KB

If you do NOT see it:

• The script is installed automatically via the Shopify ScriptTag API at the OAuth callback. If it's missing, the install has been revoked or there's an expired OAuth.
• Repair from dashboard: WooshPayment → Settings → "Reinstall script tag" button. The app makes a new call POST /admin/api/2026-01/script_tags.json with the current accessToken. After the reinstall, hard-refresh the theme and repeat a real cart checkout test before traffic.
• If the reinstall fails with "OAuth expired", redo the connection from Settings → Shopify connection.

Check 2 — does the script execute?

Browser console on the cart page: look for [WooshPayment] logs. If you see [WooshPayment] Failed to create session: … it means the script arrived but the POST /api/checkout/create call failed. Open the detail in the Network tab and read the status + response body:

• 400 Invalid cart → prices changed between add-to-cart and checkout, the customer should refresh
• 401 → Shopify token revoked on the store side, reinstall the app
• 403 → store origin not in CORS allowlist, write to us

Check 3 — does the theme use a known pattern?

The script intercepts:

1. Form submit to /cart or /checkout when the theme loads the script and uses the standard cart
2. history.pushState to /checkout (modern storefront SPAs)
3. window.location.assign/replace to /checkout

If your theme uses an exotic selector (e.g. a custom handler that calls XMLHttpRequest without going through location), the script won't see it. Write to us with the store URL + theme name and we'll add the pattern.

Specific causes

Theme CDN cache

Shopify Plus sometimes has Cloudflare/Fastly in front that cache theme.liquid for 30 min. After installing the script tag, force a purge:

Shopify Admin → Online Store → Themes → "Actions" → Publish (re-publishing invalidates the CDN).

Theme CSP

If the theme sets a restrictive Content-Security-Policy, the script gets blocked. Console will show:

Refused to load script 'https://api.wooshpayment.com/api/checkout-interceptor.js' because it violates CSP

Fix: add api.wooshpayment.com to the theme's script-src, or remove the custom CSP meta (Shopify sets a safe default one).

Headless theme (Hydrogen/Remix)

WooshPayment does not natively support Hydrogen storefronts. You'll need to invoke the REST API directly:

const res = await fetch('https://api.wooshpayment.com/api/checkout/create', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ shop, cartToken, items, totalPrice, currency }),
})
const { checkoutUrl } = await res.json()
window.location.href = checkoutUrl

See API reference for the full payload.

"Buy Now" or sticky checkout apps

Apps like ReConvert, OneClickUpsell, EasyAccess can bypass your cart and call /checkout directly in ways that don't go through the intercepted patterns. Deactivate the app, verify, then reactivate step by step.

When to contact us

After the checks above, if it still doesn't work write to hello@wooshpayment.com with:

• Your store URL
• Theme name (Online Store → Themes → name next to the thumb)
• Console + Network tab screenshot
• Any [WooshPayment] log visible in the console

Useful links

• Shopify integration — initial install
• WooCommerce — Woo equivalent
• Payment fails — if the script works but the payment hangs