> [!CAUTION]
> **Important:** Chrome will be removing support for Chrome Apps on all platforms. Chrome browser and the Chrome Web Store will continue to support extensions. [**Read the announcement**](https://blog.chromium.org/2020/08/changes-to-chrome-app-support-timeline.html) and learn more about [**migrating your app**](https://developer.chrome.com/apps/migration).

We want extensions and apps to be automatically updated for some of the same
reasons as Google Chrome itself: to incorporate bug and security fixes, add new
features or performance enhancements, and improve user interfaces.

If you publish using the [Chrome Developer Dashboard](https://developer.chrome.com/webstore/developer/dashboard), you should
*ignorethis page*. Chrome Web Store submissions that pass preview are
automatically made available on the extension's Chrome Web Store item listing
and deployed to end users.

If you are hosting a CRX file on a web server and using enterprise policies to
push it to managed devices, keep reading. You should also read [Hosting](https://developer.chrome.com/docs/extensions/how-to/distribute/host-on-linux#hosting) and
[Packaging](https://developer.chrome.com/docs/extensions/how-to/distribute/host-on-linux#packaging).

> [!WARNING]
> **Warning:** **Warning:** As of M33, Windows stable/beta channel users can only download extensions hosted in the Chrome Web Store (see [Protecting Windows users from malicious extensions](http://blog.chromium.org/2013/11/protecting-windows-users-from-malicious.html)).

Previously when off-store extensions were supported, it was possible to have the binaries and
the extension be updated in lock step. However, extensions hosted on the Chrome Web Store are
updated using the Chrome update mechanism which developers don't control. Extension developers should
be careful about updating extensions that have a dependency on the binary (for example,
legacy extensions using [NPAPI](https://blog.chromium.org/2013/09/saying-goodbye-to-our-old-friend-npapi.html)).

## Overview

- A manifest may contain an "update_url" field, pointing to a location for doing update checks.
- The content returned by an update check is an *update manifest* XML document listing the latest version of an extension.

Every few hours, the browser checks whether any installed extensions or apps have an update URL. For
each one, it makes a request to that URL looking for an update manifest XML file. If the update
manifest mentions a version that is more recent than what's installed, the browser downloads and
installs the new version. As with manual updates, the new `.crx` file must be signed with the same
private key as the installed version.

> [!NOTE]
> **Note:** In order to maintain user privacy, Google Chrome does not send any Cookie headers with auto update manifest requests, and ignores any Set-Cookie headers in the responses to those requests.

## Update URL

If you're hosting your own extension or app, you need to add the "update_url" field to your
[`manifest.json`](https://developer.chrome.com/docs/extensions/reference/manifest) file, like this:

    {
      "name": "My extension",
      ...
      "update_url": "http://myhost.com/mytestextension/updates.xml",
      ...
    }

## Update manifest

The update manifest returned by the server should be an XML document that looks like this
(highlights indicate parts you should modify):

    <?xml version='1.0' encoding='UTF-8'?>
    <gupdate xmlns='http://www.google.com/update2/response' protocol='2.0'>
      <app appid='aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'>
        <updatecheck codebase='http://myhost.com/mytestextension/mte_v2.crx' version='2.0' />
      </app>
    </gupdate>

This XML format is borrowed from that used by Omaha, Google's update infrastructure. See
<http://code.google.com/p/omaha/> for more details. The extensions system uses the following
attributes for the `<app>` and `<updatecheck>` elements of the update manifest:

appid

:   The extension or app ID, generated based on a hash of the public key, as described in
    [Packaging](https://developer.chrome.com/docs/extensions/how-to/distribute/host-on-linux#packaging). You can find the ID of an extension or Chrome App by going to the Extensions page
    (**chrome://extensions**).

    Hosted apps, however, are not listed on the Extensions page. You can find the ID of any app using
    the following steps:

    - Open the app. You can do this by clicking its icon on the New Tab page.
    - Open the JavaScript console. You can do this by clicking the wrench icon and choosing **Tools \>
      JavaScript Console**.
    - Enter the following expression into the JavaScript console: `chrome.app.getDetails().id`. The console shows the app's ID as a quoted string.

codebase

:   A URL to the `.crx` file.

version

:   Used by the client to determine whether it should download the `.crx` file specified by
    `codebase`. It should match the value of "version" in the `.crx` file's `manifest.json` file.

The update manifest XML file may contain information about multiple extensions by including multiple
`<app>` elements.

## Testing

The default update check frequency is several hours, but you can force an update using the
Extensions page's **Update extensions now** button.

## Advanced usage: request parameters

The basic auto update mechanism is designed to minimize server-side work. You
just add a static XML file onto any web server such as
Apache, and update that XML file as you release new versions of your
extensions.

More advanced developers may can take advantage of the fact that we add on
parameters to the request for the update manifest to indicate the extension ID
and version. Then they can use the same update URL for all of their extensions,
pointing to a URL running dynamic server-side code instead of a static XML file.

The format of the request parameters is:

`?x=_<extension_data>_`

Where `_<extension_data>_` is a URL-encoded string of the format:

`_id=<id>_&v=_<version>_`

For example, say you have two extensions, both of which point to the same update URL
(`http://test.com/extension_updates.php`):

- Extension 1
  - ID: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  - Version: "1.1"
- Extension 2
  - ID: "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
  - Version: "0.4"

The request to update each individual extension would be:

- `http://test.com/extension_updates.php?x=id%3Daaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%26v%3D1.1`
- `http://test.com/extension_updates.php?x=id%3Dbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb%26v%3D0.4`

Multiple extensions can be listed in a single request for each unique update URL.
For the example, if a user has both of the extensions installed, then the two requests are merged into a
single request:

`http://test.com/extension_updates.php?x=id%3Daaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%26v%3D1.1&x=id%3Dbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb%26v%3D0.4`

If the number of installed extensions using the same update URL is large enough that a GET request
URL is too long (over 2000 characters or so), the update check issues additional GET requests as
necessary.

> [!NOTE]
> **Note:** In the future, instead of issuing multiple GET requests, a single POST request might be issued with the request parameters in the POST body.

## Advanced usage: minimum browser version

As we add more APIs to the extensions system, it's possible you will want to release an updated
version of an extension or app that will work only with newer versions of the browser. While Google
Chrome itself is auto updated, it can take a few days before the majority of the user base has
updated to any given new release. To ensure that a given update will apply only to Google Chrome
versions at or higher than a specific version, you add the "prodversionmin" attribute to the `<app>`
element in your update manifest. For example:

    <?xml version='1.0' encoding='UTF-8'?>
    <gupdate xmlns='http://www.google.com/update2/response' protocol='2.0'>
      <app appid='aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'>
        <updatecheck codebase='http://myhost.com/mytestextension/mte_v2.crx' version='2.0' prodversionmin='3.0.193.0'/>
      </app>
    </gupdate>

This would ensure that users would auto update to version 2 only if they are
running Google Chrome 3.0.193.0 or greater.