Investigate what other popular web extension products do with edge cases (e.g. install web extension before logging in, sync, etc.)

[rhelmer]

Particularly interested in other extensions that require authentication and pass tokens to the extension, and how they behave when the auth token expires in the extension.

[Carla-Moz]

Some extensions like Grammarly don't redirect users to a site to sign in until the extension is clicked. This is probably the least favored flow because users can easily forget the extension and never get authenticated. MultiPass, however, has a pop-up telling the user to pin the extension and to click it to get things started as soon as the user adds it. I've seen multiple extensions do this with a pop-up and redirect users once the extension is clicked. Others like Bitmoji follow our flow for when users add an extension before logging in. It redirects users to a site to authenticate after the extension is added. Considering how we don't want users to simply add our extensions to their browsers and forget to sign in, the redirect flow to the website to sign in still looks like the best method.