Submission requirements
Everything your package needs before it can pass automated pre-review and reach a human reviewer.
Overview
Extention is a publishing automation and review layer on top of the Chrome Web Store. You keep your own developer account; we prepare the package, run policy and security checks, and call the Chrome Web Store Publish API on your behalf using your own OAuth token.
A submission moves through five states: draft → pending_review → approved → published, with needs_changes and rejected as terminal branches you can resolve and resubmit.
Manifest V3 requirements
Manifest V2 packages are rejected at upload. Chrome no longer accepts new V2 submissions, so we block them before you are charged rather than after.
Your manifest.json must declare:
- "manifest_version": 3
- "name", "version", and "description"
- An icons block including a 128×128 entry
- A service worker rather than a background page
- host_permissions listed separately from permissions
Graphic asset specs
| Asset | Dimensions | Format | Required |
|---|---|---|---|
| Icon | 128 × 128 | PNG | |
| Screenshot | 1280 × 800 or 640 × 400 | PNG / JPEG | |
| Small promo tile | 440 × 280 | PNG / JPEG | |
| Large promo tile | 920 × 680 | PNG / JPEG | |
| Marquee promo tile | 1400 × 560 | PNG / JPEG | |
| Promo video | YouTube URL | Public / unlisted |
At least one and at most five screenshots are accepted. All dimensions are enforced client-side before upload and re-verified server-side.
Permission justifications
When you upload a package we parse the manifest and generate one required justification field per sensitive permission. A justification must state what the permission does in your extension and why the single purpose cannot be achieved without it.
A strong justification:
- Names the concrete feature that uses the permission
- Explains the user-initiated action that triggers it
- States what data is accessed and what is not
- Matches the declared single purpose of the extension
Review pipeline
Automated pre-review runs as a background job the moment you submit. Failures are returned with actionable errors and never reach a human reviewer, so you are not waiting in a queue for a fixable problem.
Manifest version is 3
V2 packages are rejected at upload.
No eval() or new Function()
Flagged by the AST scanner as remote code execution.
No remotely hosted code
External <script src> and dynamic imports from remote origins are blocked.
Readable source
Fully obfuscated bundles without readable source are rejected.
Permissions match justifications
Every declared permission needs matching justification text.
Privacy policy reachable
The URL must resolve publicly — not blank, not localhost.
Package passes malware scan
ClamAV scans the archive before human review.
Within size limits
Package and file-count limits mirror Chrome's own thresholds.
Publish API
On approval we call the Chrome Web Store Publish API using the submitting developer's own OAuth token, scoped to https://www.googleapis.com/auth/chromewebstore. The resulting item ID and public listing URL are stored against your extension record.
Token expiry triggers a re-authentication prompt rather than a silent failure. Chrome-side quota limits and policy rejections are surfaced verbatim in your dashboard.
Security model
- Google access and refresh tokens are encrypted at rest
- Packages and media are stored in S3/R2 and served via signed URLs
- Card data never touches our servers — hosted checkout only
- Payments are confirmed by signed webhook, never a browser redirect
- Every review action and payment transition is written to an audit log
Ready to submit your first package?
The wizard validates as you go — you will know before you pay.