Skip to main content
These globals are injected automatically into every backend script execution. They are read-only — you cannot modify them directly.

request

Information about the current HTTP request.

request.body

When a page receives a POST request with a JSON body, it is parsed and available as request.body. Pages accept both GET and POST requests — the same backend script runs for both. Use request.method to distinguish.
The body is capped at 64 KB. Larger payloads are silently dropped (request.body will be null). Only JSON content types are parsed — form-urlencoded and multipart are not supported.

request.headers

A subset of request headers is exposed:
Full request headers are not exposed to prevent leaking internal infrastructure details (e.g. proxy headers, auth tokens).

customer

The current customer object from the session, or null if no customer is set. Populated after checkout or check-order login.

is_customer

Boolean. true if the visitor has an active customer session (completed a purchase or logged in via check-order).