# Extension URLs

Synapse extensions are self-contained, compiled code modules. They can be loaded from many different sources including the local file system, S3-compatible storage, and HTTP servers. For security purposes, it’s highly recommended that you only use extensions from trusted sources and pin them to specific versions using checksums.

A typical extension URL takes the following form:

[https://cdn.cerbos.cloud/synapse/extensions/awesome\_extension.wasm?checksum=sha256:677cce2788330f16f27981130eaa50aa4189beab2121903bcea5b3c4c918dccc](https://cdn.cerbos.cloud/synapse/extensions/awesome_extension.wasm?checksum=sha256:677cce2788330f16f27981130eaa50aa4189beab2121903bcea5b3c4c918dccc)

The `checksum` parameter is optional but is highly recommended for security. It can be appended to any URL kind listed below — including plain file paths.

## Supported URL types

### Local files

- `/path/to/extension`

- `/path/to/extension?checksum=sha256:677cce2788330f16f27981130eaa50aa4189beab2121903bcea5b3c4c918dccc`

### HTTP

- `https://extensions.example.com/foo/v1.0.0/extension.wasm`

- `https://user:password@extensions.example.com/foo/v1.0.0/extension.wasm`

- `https://extensions.example.com/foo/v1.0.0/extension.wasm?checksum=sha256:677cce2788330f16f27981130eaa50aa4189beab2121903bcea5b3c4c918dccc`

### S3

- `s3::https://s3.amazonaws.com/bucket/extension.crbs?aws_profile=synapse`

- `s3::https://s3.amazonaws.com/bucket/extension.crbs?checksum=sha256:682fbae4eb8607a9bae23ca8f31fb30becdc8c0a9cecc89e81589db4fc5edac5`

### GCS

- `gcs::https://www.googleapis.com/storage/v1/bucket/extension.wasm`

- `gcs::https://www.googleapis.com/storage/v1/bucket/extension.wasm?checksum=sha256:682fbae4eb8607a9bae23ca8f31fb30becdc8c0a9cecc89e81589db4fc5edac5`

Credentials for accessing S3 and GCS objects are sourced from the environment using the standard credential resolution method recommended by the provider.