plugins

Installation
SKILL.md

Crystallize Plugins

A Crystallize Plugin is a vendor-hosted application that extends the Crystallize App UI inside iframes at predefined placement points. Plugins do not run code in the App UI itself — they receive a scoped Backend Token to act on behalf of the signed-in user via Crystallize APIs, and any secrets they need are encrypted client-side with the vendor's own public key.

The full normative contract — entities, fields, JWE/JWT specs, request shapes, sequence diagrams — lives in references/plugin-contract.md. This SKILL.md is the builder's guide: how to ship a plugin end-to-end. Read the contract when a field, security guarantee, or wire format is in question.

Consultation Approach

Before writing code, get the lay of the land:

  1. What does the plugin do? Pure UI widget, server-side action on a Crystallize entity (order, customer…), or tenant-wide dashboard? This drives the entrypoint placements.
  2. Does it need to call Crystallize APIs? If yes, you'll use the backendToken from the decrypted payload as a Bearer credential.
  3. Does it need secrets? API keys, webhook URLs, third-party credentials — these go in secrets[] and are encrypted in the installer's browser. Crystallize never sees plaintext.
  4. Where does it run? Plugins are server-hosted (Cloudflare Worker, Vercel/Netlify edge, Lambda, plain Node/Bun server). Pure static hosting is not sufficient — the upstream must accept POST requests and decrypt JWE payloads.
  5. Which tenant(s)? Plugins are installed per-tenant. One plugin can be installed on many tenants, each with its own configuration.

Architecture in 30 Seconds

Three entities (full detail in the contract):

Related skills

More from crystallizeapi/ai

Installs
1
GitHub Stars
4
First Seen
2 days ago