Support

Contact

General support: Email support

Include the extension version, Chrome version, non-secret error code, and reproduction steps. Never send access tokens, refresh tokens, authorization codes, cookies, or complete provider responses.

Authentication does not complete

1. Open the extension options and verify that the experiment is enabled.
2. Select Remove stored authorization, then retry sign-in.
3. Confirm Chrome has not disabled the extension.
4. Select Reconnect, then approve the exact website origin shown in the trusted extension options page.
5. Try the explicit device-code fallback if browser sign-in is unavailable.
6. Record only the sanitized status text and error code.

The website cannot reach the extension

1. Copy the exact 32-character ID from chrome://extensions.
2. Paste it into the workbench. It connects automatically; select Reconnect only if needed.
3. For production, confirm the website’s exact HTTPS origin appears in the submitted extension’s externally_connectable.matches.
4. Reload both the extension and the workbench after changing deployment configuration.

Delete local extension data

Use Remove stored authorization or disable the experiment in extension options. Both remove session and remembered-profile copies of the refresh credential and account-routing ID, plus the pending login transaction and callback rule. Uninstalling the extension removes its Chrome storage.

Workspace files live separately in the user-selected directory, memory, or website OPFS storage and are not owned by the extension.

Removing local state does not itself revoke a provider-side grant. Use the provider's verified account-security controls if you also need provider-side revocation.

Report a vulnerability

Security contact: Report a security issue

Do not include live credentials or exploit other users. Provide a minimal reproduction and allow reasonable time for remediation before public disclosure.