Skip to main content
Plugs run in a separate service that is built to contain code that Collabase did not write. Design your plug for these rules.

​
What a plug can reach

A plug that has to reach a system in your own network cannot do it from the sandbox. Offer the system a public, protected address, or send events to a webhook flow from inside your network.

​
What a plug receives

Each call gets one short-lived token for one workspace and the connection of the step that is running. The token allows the store, files and the connections that the step names, and nothing else.

​
Time, memory and files

A process that failed is discarded and never reused, so do not keep state in memory between calls. Use the store.

​
Libraries

Everything the plug imports is bundled into one file when you build. Dependencies need an allowed licence. Do not rely on native programs or on files on disk. The process does not have the packages of the host.

​
Code that is not allowed

A plug is not a way to run code that a flow author supplies. Do not use eval or new Function on input values. Collabase refuses to accept this as a design.

​
If the sandbox is not available

If the sandbox service is missing or degraded, the Collabase plugs keep working and the plugs that Collabase did not write do not. A run that needs the sandbox waits and tries again. See Automation sandbox.
Last modified on October 26, 2026