A developer shares lessons from shipping their first Chrome extension (XPilot) — a gamification layer for X/Twitter activity. The post covers the Manifest V3 service worker model, OAuth 2.0 with PKCE inside a Chrome extension using chrome.identity.launchWebAuthFlow, pitfalls around canonical domain mismatches and CORS, detecting activity on X's dynamic DOM, local-first data architecture to keep costs low, and Chrome Web Store submission requirements. Key takeaways: decide www vs apex before OAuth, test the store ZIP early with private testers, keep v0.1 brutally small, and budget time for store admin beyond engineering.
Table of contents
Why an extension (and not another web app)The stack (keep it boring)What "done" meant for v0.1Hard part 1: Manifest V3 is not "Chrome apps 2.0"Hard part 2: Sign in with X inside ChromeHard part 3: Detecting activity on a hostile DOMHard part 4: Local-first is why a free tier can stay freeHard part 5: The Chrome Web Store is a product surfaceWhat I would do differently next timeThe emotional part (because shipping is emotional)If you want to try XPilot (it is free)Quick FAQ for buildersClosing1.4K Impressions1 Comment