Custom Script Component - Scanova API Documentation

Overview

The Custom Script Component enables you to insert custom JavaScript into QR Code landing pages.
It supports two modes of integration:

External scripts (e.g., Google Analytics, Facebook Pixel, chat widgets, etc.)
Inline scripts (executed directly within the landing page)

This component allows up to five (5) external scripts and a single inline script block for page customization.
⚠️ Note: Always ensure custom scripts follow Scanova’s security and content guidelines to prevent vulnerabilities such as XSS.

Properties

Property	Type	Required	Description
external	`array<object>`	No	A list of external JavaScript URLs to be loaded on the page (max 5).
script	`string`	No	Inline JavaScript code to be executed directly on the page.

🧩 External Object

Sub-Property	Type	Required	Description
url	`string`	✅ Yes	HTTPS link to the external JavaScript file (`.js`). Must be a valid URI.

Used In Categories

This component is used in the following QR Code categories:

Example Schema

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "title": "Custom Script Component",
  "description": "Schema to validate custom script component",
  "type": "object",
  "required": [],
  "additionalProperties": false,
  "properties": {
    "external": {
      "type": "array",
      "additionalProperties": false,
      "maxItems": 5,
      "$comment": "Allows 5 external links",
      "items": {
        "type": "object",
        "required": [
          "url"
        ],
        "additionalProperties": false,
        "properties": {
          "url": {
            "type": "string",
            "format": "uri",
            "pattern": "(https?://.*\\.(js))$"
          }
        }
      }
    },
    "script": {
      "type": "string"
    }
  }
}

Notes

You can include up to 5 external scripts via the external array.
All external scripts must be **publicly accessible HTTPS URLs ending with **.js.
Inline script should only include non-blocking JavaScript to maintain page load performance.
Scripts are sandboxed and validated for security — avoid DOM manipulation or unsafe global overrides.