← Addonium

3. Addon Types

Addonium defines exactly two addon types. Every addon is one or the other - there is no third "partially locked" state; partial restriction is expressed through auth.required: false + allowlist (§10), not through a new type.

3.1 Open Addon

  • auth.required is false (or the auth block is absent entirely).
  • No token, no key, no login. Anyone who has the addon's URL/manifest can use every resource it exposes.
  • May still declare a clients.allowlist (§10) to restrict which apps (not which users) may call it - e.g. "only my own official client."
  • Distributed as: manifest.json only.

3.2 Locked Addon

  • auth.required is true.
  • Requires proof of authorization on every call: a bearer token, a signed tokenized URL segment, and/or a decryption key for a compiled module.
  • The author decides what "authorized" means - a paid license key, an invite code, a per-user token they issued manually, anything. Addonium does not prescribe an identity provider.
  • Whether a Locked Addon persists any user data is optional and defaults to false (§11). When data is stored, correlating identifiers travel encrypted inside the URL itself, not in a server-side user table the spec mandates.
  • Distributed as: manifest.json with a tokenized baseUrl, and/or a compiled module + key.