Sign-in happens on the CRM’s own page
Held in memory, renewed one at a time
identity, storage and alarms, plus the CRM
Chosen in the popup, or the browser’s
Search, start and stop a timer, log time by hand, then sign out and back in through the SSO. Everything runs in this page: nothing reaches a CRM, and the clients and tasks are made up.
Tasks › #482
Home: hero and navigation
Timesheets
| Member | Time | Note |
|---|---|---|
| Alex Rivera | 11:20–now · 1:12 |
Home: hero and navigation
Made-up data. Nothing on this page reaches a CRM.
What the extension would send, as you use it.
The extension never sees a password. It opens the CRM’s sign-in in a window of its own and gets back a code it can use once.
Sign in with werun.dev
The extension opens the CRM’s sign-in in a Chrome window, with a PKCE challenge only it can answer.
The CRM’s own sign-in
Google, a passkey or a password, the same as opening the CRM. The account has to be active, and its role allowed to use the extension.
A one-time code
The CRM sends back a code valid for two minutes, and the extension trades it for its tokens.
Short-lived tokens
A 15-minute access token held in memory, and a refresh token that changes every time it is used. Ending the session in the CRM closes it on the next call.
A task found in two words, a timer that is the CRM’s own, and the day’s hours where the team can see them.
Type client and task in any order: “lumen home” finds Lumen Legal’s tasks that start with Home. Accents and capitals do not matter.
Play starts the timer Perfex already has. A timer started here shows in the CRM, and one started in the CRM shows here.
Every entry with its time, task and note, and time logged by hand when the timer was forgotten: 1:30, 45m or 1h 30m.
An alarm a minute keeps the icon current. The task list syncs every two minutes while a timer runs and every ten when none does.
The list the Web Store review read, with the reason for each.
| Permission | Why it is there |
|---|---|
identity | Opens the CRM’s sign-in window and receives the one-time code, so nobody types a password into the extension. |
storage | Keeps the CRM session, the chosen language and a one-day copy of the task list. Signing out deletes them. |
alarms | Updates the running time on the toolbar icon every minute, and syncs when a timer is started or stopped in the CRM. |
https://crm.werun.dev/* | Reads the tasks assigned to the person signed in and records their time. No other site. |
The extension is the small part. The CRM decides who can use it and what they see.
What it reads, what it keeps, where and for how long: the policy its store listing points to.
The Time Tracking module answers with the person’s own tasks and timers, and only to the extension IDs allowed in the CRM’s settings.
“Use the Chrome extension” is a permission in the CRM’s roles. Removing it, deactivating the person or ending their session cuts access on the next call.
A team member without the extension sees a short guide inside the CRM: install it from the Web Store, sign in, and the guide notices on its own.
Every connected extension is listed in the CRM with its device and last use, and administrators can close any of them.
Clients click any element of their site and leave a comment. It becomes a task in the CRM project, with a screenshot and the page details.
Manifest V3 extensions for the Chrome Web Store, built together with the API they talk to. People sign in with an account they already have, and what they do in the browser lands in your CRM or your app.