The Extension Manifest: Fields, Scopes, Permissions
Write a valid manifest — required fields, scopes, permission UX.
What You Will Learn
- Write a valid Extension manifest.
- Configure required fields.
- Set scopes minimally.
- Design permission UX.
- Validate manifest.
Why This Matters
The manifest is the Extension's contract with Copilot. Wrong fields, over-scoped permissions, or invalid structure break installation and trust.
Concept Explained
Manifest is a JSON file describing the Extension: name, display name, description, hooks (participant name), OAuth config, endpoints, icons.
How It Works
Create manifest.json. Required fields: name, display_name, description, hooks.participant, endpoints.base_url. Optional: oauth (client_id, scopes), icons.
Step-by-Step Tutorial
1. Create manifest.json
Required fields first.2. Set participant name
@your-extension-name. Must be unique.3. Configure OAuth
Client ID, minimal scopes.4. Set endpoints
base_url where Extension is hosted.5. Add icons
Display in marketplace.6. Validate
JSON valid; fields correct.Real-World Example
A team's manifest had over-scoped OAuth (write:repos when only read:catalog was needed). Users rejected install. Fixed scope; adoption increased. Lesson: minimal scopes build trust.
Example Prompts / Commands / Code
{
"name": "service-catalog",
"display_name": "Service Catalog",
"description": "Query the internal service catalog from Copilot Chat.",
"hooks": {
"participant": "@catalog"
},
"endpoints": {
"base_url": "https://catalog-extension.corp.example.com"
}
}
"""{
"name": "service-catalog",
"display_name": "Service Catalog",
"description": "Query the internal service catalog.",
"hooks": {
"participant": "@catalog"
},
"oauth": {
"client_id": "Iv1.abc123",
"scopes": ["read:catalog"]
},
"endpoints": {
"base_url": "https://catalog-extension.corp.example.com"
},
"icons": {
"default": "https://catalog-extension.corp.example.com/icon.png"
}
}
"""
Common Mistakes
- Over-scoped OAuth — users reject install.
- Missing required fields — install fails.
- Vague description — users don't understand value.
- Invalid JSON — install fails silently.
Best Practices
- Set minimal scopes (least privilege).
- All required fields present.
- Clear, specific description.
- Valid JSON (validate before publishing).
- Test install end-to-end before sharing.
Troubleshooting
| Problem | How to Fix |
|---|---|
| Install fails | Validate JSON. Check required fields. Test OAuth flow. |
| Users reject scopes | Reduce scopes. Or explain why each is needed. |
Practical Exercise
Your Turn
Write a manifest for your Extension. Validate JSON. Test install.
Professional Challenge
Build a manifest validator script. Run on all team Extensions before publishing. Catch errors early.
Key Takeaways
- Manifest = Extension's contract with Copilot.
- Required: name, display_name, description, hooks, endpoints.
- Minimal OAuth scopes.
- Clear description.
- Validate JSON before publishing.
Frequently Asked Questions
Can I update a manifest after publishing?
Where do I host the manifest?
Further Reading
Official References
SEO Metadata
SEO title: The Extension Manifest: Fields, Scopes, Permissions
Meta description: Write a valid manifest — required fields, scopes, permission UX.
Primary keyword: the extension manifest
Secondary keywords: the extension manifest: fields, scopes, permissions
Search intent: Informational
URL slug: /copilot-extension-manifest-fields-scopes
Categories: AI Tools, GitHub Copilot
Tags: GitHub Copilot, Professional, Extensions, Manifest, OAuth Scopes, IMCSEIAN, Tutorial, IMCSEIAN
Featured image concept: IMCSEIAN lesson card for The Extension Manifest: Fields, Scopes, Permissions
Comments
Comments
Post a Comment