#19. FAQ

Does an addon have to run anywhere special? No. Any HTTPS-capable server (a $5 VPS, a Raspberry Pi, a static host for Open Addons with pre-baked data, or nothing at all for a pure compiled module) works. Addonium has no relationship with Cloudflare Workers or any other specific platform - that's a choice some other addon ecosystems make, not this one.

Can I make my addon both Open and restricted to my own app? Yes - set type: "open", auth: null, and still set clients.enforced: true with your own clientId in allow. No login required, but only your official client (or ones you've explicitly trusted) will be honored.

Do I have to store any user data? No. storesData defaults to false. Even Locked Addons can be entirely stateless - the token just proves authorization, it doesn't have to correlate to a stored record at all.

What stops a host from ignoring my auth/clients config? Nothing prevents a malicious host from trying to call your server directly without the header you asked for - that's true of any HTTP API. Your own server is the enforcement point: reject requests that don't carry what auth and clients describe. The spec's job is to give well-behaved hosts an unambiguous, shared way to comply with what you've declared; it isn't a DRM system.

Can I update my addon without users reinstalling? Yes. For HTTP addons, just update your server - hosts re-fetch manifest.json per your update.checkInterval. For compiled modules, publish a new .aium file at the same manifestUrl/download location; users only need to re-import if the key itself changes.

What if I want a community index of addons? Optional and separate from the core spec - see §12.4. Nothing about discovery is required for an addon to be fully functional.

Can I mix Open and Locked resources in one addon? Not within a single manifest - type is addon-wide. If you want a public search tier and a paid streaming tier, ship two addons (or one Open addon for search plus one Locked addon/module for stream) so the access model of each installable unit stays unambiguous to hosts and users.