Paste the entire HTML file. We'll pull out the parts GrapesJS needs, and load it into the currently selected page.
Give your page a name. You can start editing it right away.
A page named this already exists in this project.
Code here runs on the published page. Never paste passwords, API secrets or private tokens.
These settings apply to published pages. Secrets are write-only and are never included in your site files.
supabase/project-settings-migration.sql before settings can be saved.No cookies and no raw IP storage. Do Not Track is respected. Analytics is not gated by cookie consent.
Add ?pa_ignore=1 on your site to exclude your browser.
Optional tags remain inert until consent is accepted. Configure cookie consent to show visitors the choice.
Code here runs on your published site for every visitor. Review it before publishing. Consent-gated snippets stay inert until consent is granted.
Analytics is cookieless and does not require consent. Tracking tags and tagged custom code are loaded only when their category is accepted.
Captcha and connected destinations are configured here. Secret values are saved separately and cannot be read back.
Supported: Generic webhook, Google Apps Script, Zapier, Make, Slack, Discord, Telegram, Mailchimp, Brevo, Kit/ConvertKit, Airtable, HubSpot, and Notion. Put webhook URLs, API keys, and tokens in the write-only secret JSON below. A webhook URL is saved as connector:id:webhook_url.
Honeypot, minimum fill time, link limits, captcha, and rate limits are checked by the server. Connector delivery runs after the submission is saved.
Collect up to 10 short text, choice, or checkbox values before hosted checkout. Do not ask for card details, passwords, or security codes.
Send signed order events to up to five HTTPS endpoints you control. Secrets are shown only when created or rotated. Verify the raw request body and timestamp within five minutes before processing; use the delivery ID for idempotency.
Only needed if your own server receives these webhooks. Every request is signed so your server can confirm it is genuine and was not forged or replayed. If you use Zapier or Make, you can skip this. The signature is lowercase hex HMAC-SHA256 over timestamp.body, prefixed with v1=. Use the exact raw body bytes.
const expected = 'v1=' + crypto.createHmac('sha256', secret).update(timestamp + '.').update(rawBody).digest('hex'); if (Math.abs(Date.now()/1000 - Number(timestamp)) > 300 || !timingSafeEqual(signature, expected)) reject();$expected = 'v1=' . hash_hmac('sha256', $timestamp . '.' . file_get_contents('php://input'), $secret); if (abs(time() - (int)$timestamp) > 300 || !hash_equals($expected, $signature)) { http_response_code(400); exit; }Allowed link hosts: Stripe (buy.stripe.com, donate.stripe.com), Square (square.link), PayPal (paypal.me), Flutterwave, Paystack (paystack.com), Razorpay (rzp.io, pages.razorpay.com). Links from other hosts are removed when you publish.
Payment keys are encrypted at rest using a separate payment-only encryption key. Payment functions decrypt a key only when they need to contact its provider. No person or screen can read it back, and keys are never included in published files. Key changes are logged below.
What we cannot protect against: if a provider key is leaked or misused, contact that provider and rotate it. Use restricted keys with only the permissions your checkout needs.
Finite retention deletes order records after the selected period, including paid sales records. Choose a finite period only if it suits your accounting and legal requirements.
Checkout email, name, and custom-field values are stored with the order. Deleting data for an email removes those customer details and custom fields while retaining the anonymized order total and status.
Use test keys first. Enable only the webhooks you need. Rotate keys if you suspect a leak.
Cookieless first-party analytics. Raw IP addresses are not stored.
Are you sure you want to delete ""? This can't be undone.
This adds the selected element to "My Components" in the Elements panel. Copies you drop later are independent — editing one won't update the others.