SafeAssist Docs
Dashboard

Browser filler extension

The SafeAssist filler is a Chrome extension that types a saved website login into the page when you ask it to. It does not autofill on page load, and it only works on https pages whose address exactly matches the site you saved in the dashboard.

Before you install

  • You need a SafeAssist account with at least one saved login under Saved logins in the dashboard.
  • Save the site using an https URL (for example https://github.com). The filler matches the page origin exactly.
  • You need the same Auth0 SPA settings as the dashboard, plus one extra callback URL for the extension (shown in extension settings after you load it).

Install (developer / unpacked)

  1. Run pnpm --filter callvault-filler package:dev in the monorepo.
  2. In Chrome, open chrome://extensions, turn on Developer mode, then choose Load unpacked and select extensions/callvault-filler/dist/unpacked-dev.
  3. Open the extension's settings page. Set the API base URL (production or your local API), tenant ID, and Auth0 domain, client ID, and API audience.
  4. Copy the Auth0 callback URL shown in settings into your Auth0 application's allowed callback URLs list, then save in Auth0.

For a Chrome Web Store zip, run pnpm --filter callvault-filler package in the monorepo. After Google assigns an extension ID, update Auth0 using docs/chrome-web-store-filler-auth0.md.

Sign in

  1. Click the SafeAssist extension icon in the toolbar.
  2. Choose Sign in to SafeAssist.
  3. Complete Auth0 in the browser window. SafeAssist issues a short-lived extension session token. It is stored in the browser session, not on disk as a saved password.

Fill a login

  1. Open the https site you saved (same origin as in Saved logins).
  2. Click the SafeAssist extension icon.
  3. Pick the username entry for this site, or choose Show fill button on this page and click that button when you are ready.
  4. SafeAssist fetches the password for that one fill, types into the username and password fields, and does not keep the password in extension storage.

What the filler refuses to do

  • Fill on http:// pages.
  • Fill when the tab origin does not exactly match the saved site origin.
  • Run silently when a page loads.
  • Store plaintext passwords in extension storage.

API endpoints (for developers)

The extension exchanges your Auth0 access token for a short-lived session at POST /v1/extension/session, then calls GET /v1/extension/filler/matches and POST /v1/extension/filler/fill with the extension Bearer token. See Core endpoints for the rest of the API.