All systems operational200+ sites monitoredResponse SLA <4h
Chrome extensions

Chrome extensions, signed in to the systems you already run.

Manifest V3 extensions for the Chrome Web Store, built together with the API they talk to. People sign in with an account they already have, and what they do in the browser lands in your CRM or your app.

2
Extensions of our own

Client Feedback and Time Tracking

200+
Sites running

Built and actively maintained

<4h
Response SLA

Critical issue response

12+
Years building

The systems behind the browser

Built and run by us

Two extensions in the Chrome Web Store, both ours.

One for our clients and one for our team, each connected to our own Perfex CRM. Each has a page with a working copy you can try.

Public · for clients

Client Feedback

Clients click any element of their site and leave a comment. It becomes a task in the CRM project, with a screenshot and the page details.

  • Pins on the element, per screen size
  • Replies and “solved” from the page
  • A token per review round
Internal · werun SSO

Time Tracking

Time on CRM tasks from the toolbar: search by client or project, press play, and the timer that runs is the CRM’s own.

  • Sign-in with Google or a passkey
  • Search in any word order
  • Running time on the toolbar icon
Why it matters

Most extensions ask for a key and for every site you visit.

The quick way to build one is a settings field for an API key and a permission to read every page. It works until somebody leaves, or until the Web Store review asks why. We build them the other way round.

The usual way

  • One shared API key, pasted into every install
  • Permission to read and change every website
  • Code fetched from a server after install
  • One language, and a listing written last

How we build them

  • A sign-in or a token per person, scoped and revocable
  • Only the sites it needs, asked for when it needs them
  • Everything inside the package Google reviewed
  • English and Spanish, in the extension and the listing
What we build

Four kinds of work.

The extension is the visible part. Most of the work is what it signs in to and what it is allowed to touch.

01

Tools for your own team

The job your team does across five tabs, done from the toolbar instead. Ours is Time Tracking: time on CRM tasks, signed in through our own SSO.

  • —Sign-in through your own accounts (OAuth 2.0 + PKCE)
  • —Access decided by roles in your back office
  • —Toolbar badge, shortcuts and alarms
  • —Sessions you can see and close
02

Extensions for your clients

Something your clients install to work with you, public on the Chrome Web Store. Ours is Client Feedback: comments on their own site that arrive as tasks.

  • —Overlays isolated from the host page
  • —Site access asked for at the moment it is needed
  • —Screenshots and page context
  • —A token per client, revocable in a click
03

The API it talks to

An extension is a client. The endpoints, the tokens and the rules live on your side: a module in your CRM, a plugin in WordPress or routes in your own application.

  • —Endpoints scoped to what the extension does
  • —Tokens issued, rotated and revoked
  • —Answers to the extension, not the open web
  • —Rate limits and an activity log
04

Web Store publishing and upkeep

The listing, the screenshots, the privacy policy and a reason for every permission, written for the review in two languages. Then a versioned release each time it changes, and Chrome updates every install on its own.

  • —Listing copy and screenshots, EN and ES
  • —Privacy policy and data disclosures
  • —A reason written for each permission
  • —Versioned releases
  • —Public, unlisted or private visibility
How we work

Your listing. Your users.
Our responsibility.

Deliverable

A permission list before a line of code

Every permission the extension will ask for, the reason for each one and the data it will keep, written down before we build it. It is the text the Web Store review reads, and you approve it first.

The extension holds no password

People sign in on your own sign-in page and the extension receives a short-lived token, or a scoped one your team issues. Nobody types a password into a popup.

Your system stays the source

The extension shows and sends; your CRM or your app decides. A timer started in the browser is the CRM’s own timer, and a comment is a task in the project.

Access is asked for, not assumed

Site access is limited to the domains that need it and requested when it is first needed, so what Chrome asks the person to allow matches what the extension does.

Works better together

The rest of the system.

An extension is one surface of a system. These are the others it usually connects to.

01

Integrations

The CRM, ERP or API behind the extension, connected with a queue and a reconciler.

02

Custom applications

When the back office is yours to build: Next.js and PostgreSQL, with the extension as one more client.

03

AI & automation

What happens after the click: a workflow that routes, drafts or summarises what the extension sent.

Is there a job your team does in five browser tabs?

Tell us the steps and the system behind them. We will tell you whether it should be an extension, and which permissions it would ask for.

No commitment. Just a conversation.
Chrome extension questions