FlexSprout

From hello to live campaign

A small script.
A thoughtful start.

Connect your website once. Then create, target, and publish your onsite messages from the studio.

Before you start

You need a FlexSprout account, access to the right organization, and permission to add a script to your website. Use a staging site first if you are working on a production storefront or a shared client site.

Create your account, then open the website management area in your workspace. If you use a consent platform or a restrictive Content Security Policy, involve the person who maintains it.

1. Add your website

Create a website with a recognizable name and its hostname, such as shop.example.com. Use the exact host where the campaign will run. A local development site can use localhost.

Copy the public site key generated for that website. The key identifies your published campaigns; it is expected to appear in page source. Do not use an account password, API secret, or a webhook secret here.

2. Add the script once

Add the script through your website’s layout, theme editor, or approved custom-code area. Replace YOUR_PUBLIC_SITE_KEY with the key from your website settings, and use the API origin shown by your actual installation snippet.

<script defer src="https://app.flexsprout.com/api/deliver/sdk.js" data-site="YOUR_PUBLIC_SITE_KEY"></script>

Example origin: https://app.flexsprout.com/api. The script needs your own public site key.

The defer attribute lets HTML parsing continue while the browser fetches the script. Include it only once per page. If you install through a tag manager, check its triggering rules so it does not load a duplicate instance.

For custom SDK hooks

The SDK exposes each website instance at window.FlexSprout[YOUR_PUBLIC_SITE_KEY]. Its consent event is flexsprout:consent on window, with a detail object containing site and granted. Successful onsite captures dispatch flexsprout:subscribed on document, with site and campaignId. This capture event does not confirm subscription or delivery in an external email platform.

For an embedded form

Add an empty element where the campaign belongs, for example <div id="newsletter-signup"></div>. Set the campaign’s embed selector to #newsletter-signup. Make sure that element exists on each targeted page.

For a Content Security Policy

Your policy needs to allow the configured API origin for the SDK script and its network connections. Campaign images may need their own permitted origin. Add only the exact origins your setup uses; do not disable your policy or copy a broad wildcard exception.

3. Create a campaign and publish it

  1. Select your website and start with a curated template, organization-saved template, or campaign format. Template use creates a draft.
  2. Write the headline, body, and button, or use blocks to build 1–10 linear steps. For captures, review every field, consent, and success message.
  3. Set colors, images with appropriate alternative text, dimensions, and placement. Preview narrow and wide screens.
  4. Choose the audience, paths, trigger, and frequency. Review the schedule and any experiment settings.
  5. Save the draft. An owner or admin publishes when content and targeting are ready.

Draft campaigns are not delivered to website visitors. Publishing makes the campaign eligible for delivery, but its audience, schedule, trigger, and frequency rules still determine whether it appears. See the builder and saved-template guide for limits and permissions.

4. Check the actual visitor experience

  • Open a page on the exact registered hostname and confirm the script is present.
  • Test the trigger you chose: elapsed time, scroll, click, or desktop exit intent.
  • Dismiss and reopen as appropriate. Check keyboard navigation, Escape, and mobile layout.
  • For multistep forms, verify Next/Back validation and retained answers. A lead is created only at final capture; reloads do not restore partial answers.
  • Submit a clearly labeled test capture and confirm its consent and validated fields in your workspace and CSV. Delete the test lead afterward.
  • For a native connector or webhook, separately authorize a controlled external test and inspect the actual receiving system and recipient history. A connection check alone does not prove delivery.

Visitor frequency and experiment assignment use browser context. A fresh browser profile can help you test a first visit, but private browsing and consent restrictions may change storage behavior. Dashboard data should reflect actual activity, not the illustrative marketing examples.

Native-provider credentials/receipts and final combined verification remain pending for this expansion. Separate web push also requires explicit VAPID and a customer-own-origin service worker; integrated UI and actual provider/device delivery verification are pending. The onsite script alone does not enable push. See connections and push setup and limits.

Explain what people are signing up for, link to your own privacy notice, and collect only the fields you need. A consent sentence in a form does not automatically make a campaign compliant with every jurisdiction.

If your rules require prior permission for onsite tracking or local browser storage, arrange for your consent manager to load the SDK only after the appropriate permission. There is no automatic consent-management-platform integration promised in the current release.

The FlexSprout privacy document is a marked draft. Finalize your own privacy assessment, notices, and vendor terms before collecting real visitor information.

Not seeing your campaign?

  • Wrong website: check the public site key and exact hostname, including subdomains.
  • Still a draft: confirm the campaign is published, not paused or archived.
  • Rules do not match: check included and excluded paths, device, source, and audience.
  • Not the right time: check the start date, end date, and trigger configuration.
  • Already seen: the session or daily frequency limit may be working as intended.
  • Monthly allowance reached: website pageviews are shared across the organization. At the cap, new campaign delivery pauses until the next UTC calendar-month reset or an upgrade with available capacity. See plan allowances.
  • Blocked loading: inspect browser network errors, your CSP, consent manager, and any extension blocking scripts.
  • Missing embed: confirm the configured selector matches a real element on the page.

For a fast, visible check, use a dedicated test campaign with a short delay and a known matching page. Restore your intended targeting before a real launch.

Pausing and uninstallingPause the campaign in the studio to stop future eligible displays after cached campaign data refreshes. To uninstall the delivery script, remove it from your theme or tag manager. Removing the script does not delete existing leads or cancel an account subscription.