plugins

Build and deploy Crystallize Plugins with iframe entrypoints and installation webhooks.

4|Updated Mar 9, 2026
One-click install
npx skills add https://github.com/CrystallizeAPI/ai --skill plugins-crystallizeapi
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: plugins
Source: https://github.com/CrystallizeAPI/ai/tree/main/use-crystallize/skills/plugins
Command: npx skills add https://github.com/CrystallizeAPI/ai --skill plugins-crystallizeapi

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill removes the complexity of building, registering, and deploying Crystallize Plugins end-to-end, so you can extend the Crystallize App UI safely with iframe-based functionality.

Core Features & Use Cases

  • Plugin and revision builder guide: covers keypair generation, plugin registration, and creating immutable plugin revisions with the correct contract surface.
  • Secure installation and configuration: explains how to define JSON Schema configuration, mark secret fields, and handle per-install encrypted payloads.
  • Runtime integration: details how to implement both the post-install webhook and iframe entrypoint handlers, decrypt payloads, and call Crystallize APIs using the scoped backend token.
  • Local development and testing patterns: shows how to exercise payload delivery without relying on the App UI using the issuing mutation and how to mock payloads in Vite dev.

Quick Start

Follow the steps in this guide to generate plugin keys, create your first revision with entrypoints and a configuration schema, then implement your upstream endpoints to decrypt incoming payloads and respond to entrypoint and post-install requests.

Frequently Asked Questions about plugins

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I build and deploy Crystallize plugins with iframe entrypoints?

Crystallize plugins are built by generating RSA keypairs, registering the plugin, creating immutable revisions with JSON Schema contracts, and implementing post-install webhooks alongside iframe entrypoints for secure UI extension.

What is revision-based contract pinning for plugin configuration?

Revision-based contract pinning locks plugin configuration to a specific JSON Schema (draft 2020-12) version, ensuring tenant-scoped configuration stability and consistent encrypted secret handling across deployments.

How do I decrypt payload and verify installation webhooks for a Crystallize plugin?

Payload decryption and verification require using your generated RSA keys to decrypt incoming encrypted payloads, then implementing idempotent post-install handlers to securely process tenant-scoped configuration and secret fields.

Can I use Cloudflare Workers to host Crystallize plugin backend endpoints?

Yes, Cloudflare Workers can host the backend endpoints needed for Crystallize plugins, handling iframe entrypoint routing, payload decryption, and backend-token authenticated API access for per-tenant validation.

How do I test Crystallize plugin payload delivery locally without the App UI?

Local testing without the App UI uses the issuing mutation to exercise payload delivery directly, and you can mock payloads in a Vite dev environment to validate entrypoint and post-install webhook behavior.

Do I need JSON Schema draft 2020-12 to define secret fields in Crystallize plugins?

JSON Schema draft 2020-12 is required to define the plugin configuration contract, allowing you to mark specific fields as secret so that per-install encrypted payloads are handled securely during tenant configuration.