Uploading CRX via Chrome Web Store API

[Jebibot]

I'm trying out the new Verified Uploads feature.

However, if I try to upload the CRX file via the CWS API (PUT /upload/chromewebstore/v1.1/items/itemId), it gives the following error:

{
  kind: 'chromewebstore#item',
  id: '***',
  uploadState: 'FAILURE',
  itemError: [
    {
      error_code: 'PKG_MUST_UPDATE_AS_CRX',
      error_detail: 'You must update your item with a crx package.'
    }
  ]
}

How can I upload a CRX via the CWS API?

[Deco]

You have missed a critical part of the documentation: https://developer.chrome.com/docs/webstore/update#sign-extension-updates

Before you can upload via the API you need to sign the CRX via packaged format then upload that to the Chrome store manually on a first iteration. The reason is so that the CWS can determine that this is the key you are using going forward. 

Thanks,

Deco

--
You received this message because you are subscribed to the Google Groups "Chromium Extensions" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extens...@chromium.org.
To view this discussion visit https://groups.google.com/a/chromium.org/d/msgid/chromium-extensions/7c297f5c-ad2f-43a6-a165-88ce0dd6545cn%40chromium.org.

[Deco]

The last update to the documentation was last week, so I'd be surprised if not, though possible I suppose, the RSA signing for the API may not have been updated to be compatible with a custom one (since any uploads via the API are signed there I suppose).

On Mon, 15 Sept 2025, 10:02 Jebibot, <tjeb...@gmail.com> wrote:

I've packaged the extension via `google-chrome --pack-extension=/path/to/extension/root --pack-extension-key=privatekey.pem` and put it as the request body.

My guess is the API does not support a CRX input or cannot distinguish CRX from ZIP.

[Jebibot]

I've packaged the extension via `google-chrome --pack-extension=/path/to/extension/root --pack-extension-key=privatekey.pem` and put it as the request body.

My guess is the API does not support a CRX input or cannot distinguish CRX from ZIP.

On Monday, September 15, 2025 at 5:56:34 PM UTC+9 Deco wrote:

[Zach Warneke]

Hi,

Currently the API determines the file type based on the file name, if provided. You can provide a file name using these http headers:
X-Goog-Upload-Protocol: raw
X-Goog-Upload-File-Name: extension.crx

If the file extension doesn't match the actual file contents, then you'll get an error. I'll add a note about these headers to https://developer.chrome.com/docs/webstore/update#sign-extension-updates, sorry about that.

Zach