Chrome extension

The X3D browser extension captures a region of whatever page you are on, sends the image to the model generator, and lets you order the result printed and posted without leaving the tab. It is a Manifest V3 Chrome extension that talks to the same generation and print endpoints the website uses, authenticated with its own token.

What it does#

• Capture a rectangular region of the current tab, by click or with Alt+Shift+X.
• Read the page for context — schema.org product data, OpenGraph tags, or the h1 — to pre-fill the prompt.
• Warn when a capture comes back blank, which is what a DRM-protected video looks like to a screenshot.
• Send the image to the generator and poll for progress. Generation runs in the service worker, so you can close the popup and it keeps going.
• Open the finished model on the website: Open in X3D goes straight to /design with that exact model loaded in the viewer, the same link a History entry uses. A result with no model file falls back to the plain /design page.
• Order the finished model printed and shipped, with a shipping form in the popup.
• Show your credit balance and whether a card is on file, at the moment you open the popup rather than at the moment you submit.

Chrome 116 or newer. Permissions requested are activeTab, scripting and storage, with one host permission: https://x3dstudios.com. It has no permission to read any other site in the background.

How pairing works#

Pairing follows the device-authorization pattern used by TV sign-in flows. The extension invents a secret, you approve that secret while signed in on the website, and the extension exchanges it for a token. The alternative — the website messaging an extension directly by ID — was rejected deliberately: the extension ID would arrive in the URL, so anyone who could get you to open a link could have a token minted into an extension of their choosing.

1. 1
   The extension generates a nonce

   32 random bytes as 64 hex characters. Both pairing routes reject anything that is not exactly that shape with 400 and the message Malformed pairing code.

2. 2
   It opens the consent page

   /connect/extension?code=<nonce>&label=<name>. The page lists what is being granted in plain terms: spending generation credits, placing print orders that charge your card, and reading your credit balance. If you are signed out it sends you to sign in and comes back.

3. 3
   You approve

   The page posts to /api/extension/pair/approve, which is session-authenticated only. A bearer token cannot reach it — otherwise an extension that already had access could mint itself more. Only the hash of the nonce is stored, so the row is worth nothing if it leaks.

4. 4
   The extension claims the token

   It polls /api/extension/pair/claim with the nonce it kept. Before approval that returns 202 with { pending: true } — polling while the consent tab is open is the normal case, not an error. After approval it returns the token once, and the pairing row is deleted in the same transaction, so a replayed claim finds nothing.

5. 5
   The token is stored in the extension

   It looks like x3d_ext_ followed by 48 hex characters. The server keeps only a SHA-256 hash plus a short non-secret display prefix.

The pairing and session endpoints#

What the token can do#

Ordering by modelUrl is why the extension does not have to download and re-upload a model it just generated. A generated model already sits in X3D storage behind a gs:// URI the browser cannot fetch; the order route accepts that URI directly and re-checks that the model belongs to your account before using it.

Limits worth knowing#

• Generation spends credits, at the same rate as the website. Every extension generation starts from an image, which adds one credit to the base: a fast draft from a capture costs 2 credits and a hi-fi one costs 3, before any mesh-quality or texture-resolution options.
• Generation is rate limited at 20 starts per hour per account, shared with the website.
• Placing an order charges the card on your account. The consent page says so, and every order still needs two presses in the popup — Print & ship it, then Place order. An estimate is shown with the finished model; the amount actually charged is worked out from the file when the order is submitted, which is what the order screen tells you.
• There is no extension manager in /profile yet. The consent page points there, but the page has no extension section — revoking today means calling POST /api/extension/revoke from a signed-in browser.
• Revoking marks the token revoked rather than deleting it, so when a connection was disconnected stays answerable.
• The extension token is separate from your print-API key on purpose. An extension runs inside every page you visit, which is a far more likely place for a credential to leak, so it is minted per connection and revocable on its own without breaking a server integration.