🚀 How to Allowlist Safe Pull Request in Your Organization Using the Chrome Policy API

If you try to install Safe Pull Request inside a company or school network, you may run into this:

"This extension is blocked by your administrator."

That’s because some organizations using Google Workspace or Chrome Enterprise apply strict extension policies—-often blocking all extensions by default unless they’re explicitly allowlisted.

This can be a real blocker if your team wants to use Safe Pull Request but doesn’t want to dig through the Chrome Admin console.

✅ The Good News

Thanks to a helpful script by @tuckner, IT admins can now allowlist any Chrome extension—including this one—via the Chrome Policy API. That means:

• No more clicking around in the Admin UI
• Works at scale
• Repeatable and automatable

🧩 How to Allowlist Safe Pull Request

Here’s what to do:

1. Grab the extension ID:

   📋lgjhdicdaddeoodpifjdipgooggbojfc
   

2. Use the script below (or share it with your IT team):

   View the original gist here

   📋# Gist by @annextuckner
   # This script uses the Chrome Policy API to allowlist a Chrome extension
   
    from google.oauth2 import service_account
    from googleapiclient.discovery import build
    import json
   
    def main():
        # Authenticate the service account
        scopes = ['https://www.googleapis.com/auth/chrome.management.policy']
        admin_to_impersonate = ''
        credentials = service_account.Credentials.from_service_account_file(
            'acsa.json', scopes=scopes, subject=admin_to_impersonate
        )
   
        # Build the service for Chrome Policy API
        service = build('chromepolicy', 'v1', credentials=credentials)
        
        customer_id = 'my_customer'  # Or your actual customer ID
        org_unit_id = ''  # Replace with your org unit ID
        extension_id = 'lgjhdicdaddeoodpifjdipgooggbojfc'  # Extension ID of Safe Pull Request
        
        body = {
            "requests": [
                {
                    "policyTargetKey": {
                        "targetResource": f"orgunits/{org_unit_id}",
                        "additionalTargetKeys": {
                            "app_id": f"chrome:{extension_id}"
                        }
                    },
                    "policyValue": {
                        "policySchema": "chrome.users.apps.InstallType",
                        "value": {
                            "appInstallType": "ALLOWED"
                        }
                    },
                    "updateMask": "appInstallType"
                }
            ]
        }
        
        response = service.customers().policies().orgunits().batchModify(
            customer=f"customers/{customer_id}",
            body=body
        ).execute()
        
        print(json.dumps(response, indent=2))
   
    if __name__ == '__main__':
        main()
   

3. After running the script, users in the specified organizational unit should be able to install Safe Pull Request normally from the Chrome Web Store.

🧠 Pro Tips

• You can apply this policy to specific Org Units or to your entire domain.
• You can use the same approach to allowlist any extension—-not just Safe Pull Request.

📣 Want Help?

If you're an IT admin and you'd like help deploying this extension org-wide, feel free to contact me.

---

Safe Pull Request helps developers open pull requests safely and intentionally—-no more misdirected PRs to upstream repos. Now, it's easier than ever to roll it out across your whole team.