# Setup

> Reference for Developers > Setup: the five steps (Use case, Site type, Install, Scope, Verify), what each asks and why, and who can change them.

Source: https://docs.scriptmonitoring.com/setup/ · Plan: All plans · Updated 2026-10-13

**Developers > Setup** is where a team gets the tag and tells Script Monitoring what to watch, in five steps: **Use case**, **Site type**, **Install**, **Scope** and **Verify**. It is set once per team, because the script is issued per team and every domain in it uses the same tag. New accounts land on step 1 right after sign-up. Super admins and Admins of the team can change every step; Viewers can read it all.

![The Setup page for the Payments platform team: a five-step stepper (Use case, Site type, Install, Scope, Verify) with step 1 asking what you are monitoring for.](https://docs.scriptmonitoring.com/screenshots/setup-overview-light.webp)

## How does Setup work?

The stepper at the top shows the five steps: **Use case** (what you are monitoring for), **Site type** (how your pages load), **Install** (add the tag), **Scope** (which pages report) and **Verify** (confirm it is live). Click any step to open it, or use **Back** and **Continue** at the bottom of the card. On step 5, **Done, go to Diagnostics** takes you to [Diagnostics](https://docs.scriptmonitoring.com/diagnostics/).

Each answer is saved the moment you pick it, so there is no Save button for the steps. A step shows a check once it is done:

| Step | Done when |
| --- | --- |
| 1. Use case | A use case is chosen. |
| 2. Site type | A site type is chosen. |
| 3. Install | A domain in the team has sent a script report. |
| 4. Scope | A use case is chosen and Scope shows no blocking problem, such as **No payment page defined**. |
| 5. Verify | Steps 3 and 4 are both done. |

Each step has its own URL, so you can share a link to it. When you open Setup from **Edit scope in Setup** on the PCI DSS **Payment pages** tab, a **Back to PCI** link takes you back.

## When does Setup appear?

A new account opens Setup step 1 straight after sign-up, on the team that was created for it. A login that has just created the workspace opens it too. After that, logins land on [Home](https://docs.scriptmonitoring.com/home/), and you reach Setup from **Developers > Setup** in the sidebar.

## Who can change Setup?

| Role | What they can do |
| --- | --- |
| Super admin | Everything: answer every step, edit payment page selectors, change the Advanced settings. |
| Admin of the team | The same as a Super admin, for that team. |
| Viewer | Read every step, copy the snippet, test a URL and see Verify. The choices are disabled, with "You do not have permission to manage this team" on hover. |

## What does step 1, Use case, ask?

**What are you monitoring for?** It is asked first because it decides how much of your site reports back. You can change it later without reinstalling.

![Setup step 1, Use case: choose Client-side security, PCI DSS 6.4.3 & 11.6.1, or Both.](https://docs.scriptmonitoring.com/screenshots/setup-step-1-light.webp)

| Use case | What reports |
| --- | --- |
| **Client-side security** | Every page. Every third-party script is inventoried and alerted on. No payment pages to set. |
| **PCI DSS 6.4.3 & 11.6.1** | Scoped to your payment pages. The tag still loads on every page, and you can narrow reporting to the payment pages in step 4. Vendors, Alerts and Blocks then show only what runs on a payment page. |
| **Both** | Every page, and your payment pages are also tracked as a named PCI scope for 6.4.3 and 11.6.1. |

Pick **Both** if an assessor may ask for PCI DSS evidence and you also want cover on the rest of the site. Switching away from **PCI DSS 6.4.3 & 11.6.1** turns off **Only payment pages report**, so every page reports again.

If your workspace is still named after your email address, step 1 also asks for a **Company name**. **Save** renames the organization and its first team after your company.

## What does step 2, Site type, ask?

**Is this a single-page app?** It applies to every domain in the team and changes how the tag detects a page at all, so answer it before you install.

![Setup step 2, Site type: Multi-page site is selected; Single-page app is the alternative.](https://docs.scriptmonitoring.com/screenshots/setup-step-2-light.webp)

- **Multi-page site**: every navigation loads a new document. Server-rendered sites, classic checkout flows and most commerce platforms.
- **Single-page app**: routes change without a reload (React, Vue, Svelte, Angular, Next in client mode). The tag watches route changes instead of page loads.

For a single-page app, Setup also asks **How does your router write URLs?**: **Path routing** (`/checkout/payment`) or **Fragment routing** (`/#/checkout/payment`). With fragment routing, payment page selectors must include the fragment, such as `/#/checkout`.

## What does step 3, Install, show?

The card is titled **Install with** the method you pick, and its header shows your team's **Script URL**, `https://<teamID>.cdn.scriptmt.com/sm.js`. Every method installs the same tag, filled in with your team ID (a 14-digit number starting with 1, such as `14827391650423`), with a **Copy** button.

![The install step showing the script tag for the Payments platform team and the install method tabs: HTML, GTM, AI, NextJS, Vite and CLI.](https://docs.scriptmonitoring.com/screenshots/setup-install-snippet-light.webp)

The method tiles, and where each one is explained step by step:

- **HTML**: paste the tag at the top of the `<head>`. See [Install with HTML](https://docs.scriptmonitoring.com/install/html/).
- **GTM**: a Custom HTML tag in Google Tag Manager, for testing only. See [Google Tag Manager](https://docs.scriptmonitoring.com/install/google-tag-manager/).
- **AI**: a prompt for your AI coding assistant. See [AI assistant](https://docs.scriptmonitoring.com/install/ai-assistant/).
- **NextJS**: the Next.js component. See [Next.js](https://docs.scriptmonitoring.com/install/nextjs/).
- **Vite**: the Vite plugin. See [Vite](https://docs.scriptmonitoring.com/install/vite/).
- **CLI**: inject the tag after your build. See [CLI](https://docs.scriptmonitoring.com/install/cli/).

If you marked the site as a single-page app in step 2, a note above the tiles recommends a method by who owns the HTML shell, and GTM shows a warning that it is a poor fit for production.

Below the snippet, **CSP reporting** explains that Content Security Policy reports come from your server's headers, not the tag. **Set up CSP reporting** opens the setup sheet on CSP violations for the domain picked in the top bar. See [CSP reporting](https://docs.scriptmonitoring.com/csp-reporting/).

### What is under Advanced?

**Advanced**, at the bottom of step 3, holds the team's install settings:

- **Release channel**: which web script release the tag serves, **Latest** (the default) or **Stable**.
- **Page URL query strings**: removes query strings from page URLs before they are stored. Turn it on if your URLs carry secrets such as password reset tokens or magic links. Script URLs and URLs already stored are not changed.
- **Page monitoring scope**: URL patterns for which pages the script monitors. With no patterns, every page is monitored. Shown only for teams that have it.
- **Custom request headers**: headers attached to the script's requests so you can identify and filter them. **Add header**, then **Save request headers**.

Only Super admins and Admins of the team can change these.

## What does step 4, Scope, show?

Scope depends on the use case. With **Client-side security**, the card is **Whole site**: every domain in the team is listed and there is nothing to configure. With **PCI DSS 6.4.3 & 11.6.1** it is **Payment pages only**, and with **Both** it is **Whole site, plus a PCI scope**.

![The Scope step on the Setup page, with payment page selectors per domain, a field to test a real URL, Import CSV and Report options.](https://docs.scriptmonitoring.com/screenshots/setup-scope-light.webp)

For PCI DSS and Both, Scope has:

- **Payment page selectors**: one list that decides both what counts as a payment page for the tag and what a PCI DSS report counts as one. Type a path such as `/checkout/:step` and click **Add selector**. `*` matches anything in a segment, `:name` matches one segment, and query strings are stripped before matching. Teams that keep selectors per domain pick the domain first, and can **Import CSV**.
- **Test a real URL**: paste a checkout URL to see **Matches** (and which selector matched it) or **No match** before you rely on a selector.
- **Report options**: a side sheet with how the team's PCI DSS reports are generated.
- **Only payment pages report** (PCI DSS only): when on, pages that no selector matches send nothing, though the tag still loads on them. It becomes available once a selector has matched a real page in the last 7 days, and turning it on asks you to confirm. If it is not enabled for your team yet, Scope says so and offers **Contact support**.

![Payment page selectors for checkout.northwind.com: /checkout and /checkout/:step, where :name matches one path segment and * matches anything.](https://docs.scriptmonitoring.com/screenshots/setup-payment-pages-light.webp)

Scope also warns when the setup can be silently wrong: **No payment page defined** (PCI DSS or Both with no selector, which keeps step 4 from being done), **No domain here is marked as taking payment**, a routing mismatch between step 2 and a selector, or **A selector contains a query string**. For how to write selectors and fix each warning, see [Payment pages](https://docs.scriptmonitoring.com/payment-pages/).

## What does step 5, Verify, check?

The **Activation** card reads only what has really arrived: tag requests delivered this month and script reports in the last 24 hours.

![The Verify step of Setup confirming the tag is live on both Payments platform domains.](https://docs.scriptmonitoring.com/screenshots/setup-verify-light.webp)

| Tile | What it counts |
| --- | --- |
| **Delivered** | Tag requests served this month. |
| **Reporting** | Domains reporting, out of the team's active domains. |
| **Received** | Script reports that landed in the last 24 hours. |
| **PCI scope** | The number of payment page selectors. Shown with **Both** only. |

A note under the tiles sums it up: **Live across the site** or **Live, narrowly** (PCI DSS) when reports arrive, **Nothing has arrived yet** before the first visit, **Delivered, but never activated** when the tag is served but nothing reports, or **Setup is not complete** when step 4 has a blocking problem. **Per-domain** lists each domain with its first report and a status: **Receiving**, **Not receiving**, or **Crawled** for Agentic crawler domains. Domains that a payment page selector matches carry a **Payment page** badge. Suspended domains are left out.

The first report arrives within a minute of a visit to a page with the tag. For what each status means and how to fix it, see [Verify it's working](https://docs.scriptmonitoring.com/verify/).

## Frequently asked questions

### Do I have to finish Setup in one go?

No. Every answer is saved as soon as you pick it, and the stepper lets you jump to any step. A step shows a check once it is done, so you can come back later and see what is left.

### If I change the use case later, do I need to reinstall the tag?

No. The tag is the same for every use case. The use case only decides which pages report, so you can change it in step 1 at any time without touching your site.

### Why are the choices greyed out for me?

Only Super admins and Admins of the team can change Setup. Viewers see every step, can copy the snippet and test a URL, but cannot change the answers, the selectors or the Advanced settings.

### Why does Verify say "Delivered, but never activated"?

The tag was served this month but no script report arrived in the last 24 hours. Check that the tag is in the served HTML. On a single-page app, test a real URL in step 4. See [Verify it's working](https://docs.scriptmonitoring.com/verify/) for each status.

### Is Setup per domain or per team?

Per team. The script URL carries the team ID, so every domain in the team uses the same tag and the same answers. CSP reporting is the one thing set up per domain, from **Set up CSP reporting** in step 3.

## Related

- [Install the script tag](https://docs.scriptmonitoring.com/install/)
- [Payment pages](https://docs.scriptmonitoring.com/payment-pages/)
- [Verify it's working](https://docs.scriptmonitoring.com/verify/)
- [Diagnostics](https://docs.scriptmonitoring.com/diagnostics/)