Advanced extensions: steps, code, OAuth and sharing

Most extensions are one request to one URL. When your tool needs more, like finding an ID before the real request or signing in with OAuth, use the Advanced settings.

New here? Start with Connect your tools with extensions →

What's in here

  • Steps: run up to 3 requests before the main one.
  • Transform: reshape the response before anyone sees it.
  • Code: run your own JavaScript instead of a plain request.
  • Sign in with OAuth: connect tools that don't give out API keys.
  • Portal: let shoppers run an extension on their own orders.
  • Share: send an extension to another Commslayer account.

All of these are in Settings → Extensions. Click an extension and pick the section on the left. They aren't in the custom action editor on AI agent → Actions.

Steps

Use steps when the main request needs something you have to look up first, like a customer ID from an email address.

  1. Open the extension and go to Advanced → Steps.
  2. Click Add step. Give it a Step name in lowercase, like find_user.
  3. Pick the method, add the URL and, if needed, a Body (JSON).
  4. Use the result in later steps, the main URL and the body template as {{steps.<step name>.<path>}}.

Example: a step named find_user calls https://api.example.com/users?email={{customer.email}}. The main request then uses https://api.example.com/users/{{steps.find_user.users.0.id}}/tickets.

Good to know:

  • Up to 3 steps, run in order before the main request.
  • Credentials stay on your site. The extension's headers and authentication are only sent to steps on the same site as its URL.

Transform

Use a transform to clean up a response before the AI agent and the sidebar card see it, like joining a first and last name or dropping fields nobody needs.

  1. Open the extension and go to Advanced → Transform.
  2. Turn on Reshape the response.
  3. Write a function that returns the new shape:
export default function transform({ response, parameters, customer }) {
  return {
    name: `${response.first_name} ${response.last_name}`,
    plan: response.subscription.plan,
  }
}

Good to know:

  • No network. A transform runs in a sandbox and can only use what it's given.
  • Errors fail the run. If the transform throws, the run fails.
  • Last result shows what the transform returned the last time the extension ran.

Code

Use code when steps aren't enough, like looping over results or calling two APIs and merging them.

  1. Open the extension and go to Advanced → Code.
  2. Turn on Run code instead of the request. Click Starter code for an example.
  3. Write an async function. What it returns is what the AI agent and the card see:
export default async function run({ parameters, customer }) {
  const res = await fetch(`https://api.example.com/orders/${parameters.order_id}`)
  const order = await res.json()
  return { status: order.status, eta: order.delivery_date }
}

The editor marks a Syntax error as you type. Fix indentation tidies the code.

Which hosts code can call

  • The URL's host gets the extension's headers and authentication added for you, so keys never sit in your code.
  • Other hosts (optional): list up to 5 more. They get nothing added.
  • Everything else is blocked.

Approve hosts

New hosts in Other hosts need an admin's approval. Until then the extension doesn't run. An admin opens it and clicks Approve hosts.

Good to know:

  • Code replaces steps and transform. An extension uses one or the other.

Sign in with OAuth

Use OAuth when your tool lets apps sign in with OAuth 2 instead of giving out an API key. Commslayer adds your sign-in to every request and renews it on its own.

  1. In your tool, create an OAuth app.
  2. In Commslayer, open the extension, turn on Sign in with OAuth and copy the Redirect URL.
  3. Add the Redirect URL to the OAuth app in your tool.
  4. Back in Commslayer, fill in the Authorization URL, Token URL, Client ID, Client secret and, if needed, Scopes.
  5. Click Save, then Sign in.

The extension shows Signed in since with the date. If the sign-in stops working, click Sign in again.

Extensions that sign in as an app

Some tools, like Linear, let an app get its own token with only the client ID and secret, without a person signing in (the OAuth "client credentials" grant). The app then needs no paid seat, and your tool shows the app, not a teammate's account, as the one making changes.

An extension set up this way doesn't show Authorization URL, Redirect URL or Sign in. It shows Signed in once the Client secret is saved, and gets a new token before the old one runs out. You set this up with the Commslayer MCP: ask your AI assistant to create the extension with the client credentials grant. See Connect Claude and ChatGPT via MCP →

Good to know:

  • Only admins can sign in.
  • Save first. Sign in waits until your OAuth settings are saved.
  • Changing the client ID or secret signs the extension out, so sign in again.

Portal

Let shoppers run an extension themselves on their orders in the customer portal, like checking a repair status or requesting an invoice.

  1. Open the extension and go to Show it → Portal.
  2. Turn on Show in the customer portal.
  3. Set the Button label, up to 40 characters.
  4. Click Save.

The button shows on each order on the shopper's My orders page.

Good to know:

  • It fills in the order. Add a parameter with the type Shopify order. The portal fills it with the order the shopper is looking at, so the extension can't need other parameters.
  • A lookup shows its sidebar card fields. Turn on the sidebar card to pick what shoppers see.

Share an extension

Send a working extension to another Commslayer account, like another store you run.

  1. Open the extension on Settings → Extensions and click Share. An install link is copied.
  2. Open the link while signed in and pick the account to install it in.
  3. Check what it needs, then click Install.

Good to know:

  • Secrets aren't shared. Add your own header values or sign-in after installing.
  • It installs turned off. Nothing runs until you check it and turn it on.
  • Read the code first. If it runs code, read it in Code before you turn it on.
  • Only admins and managers can install extensions.

Troubleshooting

Step result is empty in the main request?

  • Check the path. Lists use the position, like users.0.id. Click Test to see what the step returned.

Code doesn't run?

  • Check whether an admin still has to click Approve hosts.
  • Check the host. Code can only call the URL's host and the hosts you listed.
  • Fix any Syntax error shown in the editor.

OAuth sign-in didn't work?

  • Check the Redirect URL is added to the OAuth app exactly as shown.
  • Check the Authorization URL and Token URL both start with https://.

Portal button not showing?

  • Check the extension is on and has a Shopify order parameter.
  • Check it doesn't need any other required parameter.

Related articles

Introduction to the AI agent How to set up the AI agent Training the AI agent Knowledge sources Writing guidance