Browser Extension

What it is

The eListSync browser extension captures the page you are looking at and POSTs a sanitized product payload to your workspace. It is for operators who live in supplier tabs and do not want to copy URLs into **/import**.

It is optional. URL ingest and document ingest work without it. There is no desktop installer.

Install

1. Build or use the unpacked folder extensions/toksync (or your distribution build)
2. Chrome → Extensions → Developer mode → Load unpacked
3. Point the extension at your eListSync origin (http://127.0.0.1:3000 in development)

Pin the extension so you can ingest without hunting the puzzle-piece menu.

API keys

Create a key in the dashboard (hashed into user_api_keys). Configure TOKSYNC_EXTENSION_API_KEY / the extension options page to that **plaintext** key. The server only stores a hash.

Send it as:

x-toksync-api-key: <your key>

Rotate the key if it leaks. Never commit live keys. A 401 means hash mismatch or a revoked row.

One-click import

On a product page, trigger ingest. The extension POSTs to /api/extension/ingest. CORS allows extension origins (OPTIONS → 204).

Verify with curl if the UI is unclear:

curl -X POST http://127.0.0.1:3000/api/extension/ingest \
  -H "Content-Type: application/json" \
  -H "x-toksync-api-key: $TOKSYNC_EXTENSION_API_KEY" \
  -d '{"products":[{"title":"Demo","sku":"EXT-1","price":19.99}]}'

Open the catalog. You should see the same canonical product you would get from a URL ingest of a well-formed page — then publish as usual.

Payload shape

{
  "products": [{
    "title": "Hoodie",
    "sku": "EXT-1",
    "price": 59.99,
    "url": "https://example.com/hoodie",
    "images": ["https://example.com/hoodie.jpg"]
  }]
}

Include variants when the page has them. The server sanitizes HTML and rejects private image hosts.

Security notes

• The extension runs in **your** browser; supplier cookies are not sent to eListSync unless you include fields in the JSON
• SSRF rules still apply to URLs in the payload
• Treat the API key like a password