Developer and plugin guide

#The local API

The desktop app runs a REST API on 127.0.0.1 only. Copy the port and token from Settings → API, then send them with every request:

curl -H "Authorization: Bearer $BLEND_TOKEN" http://127.0.0.1:$PORT/profiles

The full list of endpoints is in the API reference. Interactive Swagger docs are served by the app at /docs.

#Starting a profile and attaching a framework

POST /profiles/{id}/start returns a wsEndpoint. Connect Puppeteer (puppeteer.connect({ browserWSEndpoint })), Playwright (chromium.connectOverCDP) or Selenium (debuggerAddress). See examples.

#Flows, tasks and schedules

Flows are JSON graphs of nodes (start, open, click, type, wait, scroll, extract, condition, loop, end). Create them with POST /flows and run them with POST /flows/{id}/run (or on a schedule via POST /tasks). Schedules use every 15m, daily 09:30, weekly mon 09:30 or once 2026-10-20T09:30.

#Webhooks

Register a URL with POST /webhooks. Each delivery has the header blend-signature: t=<unix>,v1=<hex>, an HMAC-SHA256 of t.body with your webhook secret. Reject requests older than 5 minutes.

import { createHmac, timingSafeEqual } from 'node:crypto';
const [t, v1] = sig.split(',').map((p) => p.split('=')[1]);
const ok = timingSafeEqual(Buffer.from(v1, 'hex'), createHmac('sha256', secret).update(`${t}.${body}`).digest());

#Plugins

Blend profiles load standard Chrome extensions (Manifest V3). Upload them with POST /extensions or in the app, then enable them per profile. A native plugin SDK is planned. Until then, the API and webhooks are the supported extension points.

#Contributing

The code is a pnpm/turbo monorepo: apps/desktop (Electron), apps/local-service (API), apps/api (cloud), apps/web (this site), and packages/*. Run pnpm install && pnpm test.