Extensions

Extension Starter Repository

The public starter will provide a production-shaped baseline for iframe, webhook, and hybrid extensions without depending on Throttle's private monorepo.

Starter repository
The starter is published at github.com/Epic-Design-Labs/throttle-extension-starter. It implements the hybrid shape (embedded React iframe UI + a Cloudflare Worker backend) and is a template to copy, not a dependency. No private repository access is required.

Clone and run

Quickstart 
git clone https://github.com/Epic-Design-Labs/throttle-extension-starter.git
cd throttle-extension-starter
corepack enable   # picks up the pinned pnpm version
pnpm install
pnpm dev          # embedded UI at http://localhost:5173 (mocked bridge)
pnpm check        # format, lint, typecheck, tests, build — must pass

The five-minute quickstart runs against a mocked bridge — no Throttle account or Cloudflare deploy needed. When you are ready to build your own integration, customize the template with pnpm run setup and follow the starter README through Test-mode registration, real webhook delivery, and Cloudflare deployment.

What the starter includes

Extension surfaces

  • Iframe route and bridge handshake
  • Backend identity-token verification
  • Raw-body webhook signature verification
  • Health endpoint and structured logging

Safe integration foundations

  • Install-aware persistence
  • Idempotent event processing
  • Environment-variable template
  • Unit tests and deployment guidance

Repository strategy

Use one repository per provider integration by default. ShipStation, ERP, tax, analytics, and messaging connectors have independent credentials, data models, release schedules, incidents, and support ownership. A monorepo is reasonable only when one team deliberately shares their runtime and deployment lifecycle.

The starter is a template, not a hosted runtime dependency. Your publisher workspace owns the catalog entry; your repository and infrastructure own the application code and provider synchronization.

Required customization

  • Declare the minimum scopes and event subscriptions, chosen from the scopes an extension may request.
  • Define installation configuration without exposing provider secrets to browser JavaScript.
  • Replace example handlers with provider-specific mapping and reconciliation.
  • Add the provider's rate limits, retry policy, credential rotation, and support runbook.
  • Validate clean installation and uninstall in Test mode.

Pair the starter with the Build guide and use the security requirements as the implementation baseline.