How do I share FrontTailor settings with my team?

Export a package in the Team tab (file or clipboard) and put it on a server of your team. Colleagues subscribe to the URL or import the file and apply the changes after a preview.

How do I sign a team package?

With node scripts/sign-team-package.mjs from FrontTailor’s source code: create a key pair, put the public part into teamSync.trustedKeys and sign the package with the private key. The private key stays in the vault.

Are team packages applied automatically?

No. Even enforced packages fetched on a schedule only wait. They are applied only after the diff preview and a click.

Does team sync run through a CloudDNA server?

No. Packages live on your company’s servers, such as Git or SharePoint. FrontTailor only fetches the file with a GET.

Team packages

A team package is a JSON file with a team’s shared settings – host profiles with PROD flag, OData filters, snippets, masking rules and more. It lives on a server of your company; no CloudDNA backend is involved. Nothing is applied without a preview.

Edition: from Team
Tab: “Team”
Format: JSON fioritailor-team-package, version 1
Signature: optional, Ed25519 (JWS)
Distribution: file, clipboard, HTTPS URL, policy

What a package contains

A package can contain these sections; you choose them when exporting:

Host profiles (name, colour, PROD flag) and URL profiles
OData filters and replay requests
Snippets and PII masking rules
Palette favourites, bookmarks, known errors, morning check lists and performance budgets

Each section holds at most 500 entries, each package at most 1 MB. Invalid entries are skipped one by one and counted in the preview; unknown sections from newer versions are ignored.

No secretsURL profiles allow only sap-* parameters without credentials. For replay requests FrontTailor removes secret headers such as Authorization, cookies and CSRF tokens and redacts values such as sap-password – on export and on import.

Create a package

Open the Team tab in the DevTools panel or the side panel.
In the Export card, enter the Package name and the Author.
Under Sections, choose what goes into the package. Each section shows its number of entries.
Download saves the package as a file, Copy puts it on the clipboard.

The export is unsigned and contains the chosen sections with all local entries.

Sign a package

Signing happens outside the browser, because the private key does not belong in the extension. The script scripts/sign-team-package.mjs from FrontTailor’s source code needs only Node and no dependencies.

Create a key pair: node scripts/sign-team-package.mjs --generate-key fiori-team-2026.
Print the public part for the policy: --public-key <file>. It goes into teamSync.trustedKeys.
Sign the package: --key <file> team.json. The result is a JWS file (Ed25519, flattened JSON) that you publish instead of the package.
Keep the private key in the password vault or as a CI secret, never in the repository.

Shown at the source	Meaning	Behaviour
Signed · <kid>	Valid signature of a trusted key	accepted
Unknown key · <kid>	The key is not in the policy	accepted as long as no signature is required; note in the preview
Unsigned	no signature	accepted as long as no signature is required; warning in the preview
Invalid signature	Signature does not match or broken format	always rejected

Distribute a package

Channel	How
File	In the Import card, choose a `.json` file under Package file.
Clipboard	In the Import card, paste the package and click Check package.
Subscribe to a URL	Under Subscribe to a package URL, enter an HTTPS address of your team (Git raw file, SharePoint, internal web server) and click Subscribe. Fetch gets the package.
Policy	Your administrators set the URL with `teamSync.packages`. The package appears with the tag Administrator and is read-only.

The URL must be HTTPS (HTTP only for localhost) and must contain neither user, password nor token parameters. If the server needs a sign-in, FrontTailor uses your browser session with that host. For the fetch FrontTailor asks once for access to the package server; until then the source shows Access required with an Allow access button.

Review and apply

Nothing is applied automatically. After a fetch the source shows Changes available, and the preview lists new, changed and removed per section.

Click Review changes at the source. The preview shows the package’s version and author.
Go through the changes. Conflicts are marked and not preselected: Changed locally (from the package, changed locally since) and Own local entry.
Select or deselect single changes or whole sections.
Apply applies the selection; Decline discards all open changes, which are suggested again only with a new value.

PROD protectionA change that would remove a PROD flag carries the note Lifts PROD protection and is never preselected. The prodHosts policy keeps applying regardless.

A package never deletes entries you created yourself. If you remove a source, its settings stay as local ones.

Policy for team packages

Key	Effect
`teamSync.packages`	HTTPS URLs every user gets read-only, at most 10. URLs with credentials or token parameters are ignored.
`teamSync.trustedKeys`	Public Ed25519 keys as JWK with `kid`.
`teamSync.requireSignature`	Only packages signed by these keys, also for own subscriptions and imports. Default `true` as soon as `trustedKeys` is set.
`teamSync.autoSyncMinutes`	Fetches the enforced packages every n minutes (15 to 10,080). Without the key only on click.
`teamSync.allowUserPackages`	`false`: no own subscriptions and imports.
`modules.teamsync`	`false` hides the “Team” tab.

{
  "teamSync": {
    "packages": ["https://git.example.com/fiori/fioritailor/raw/main/team.json"],
    "trustedKeys": [{ "kid": "fiori-team-2026", "kty": "OKP", "crv": "Ed25519", "x": "<base64url>" }],
    "autoSyncMinutes": 240
  }
}

Even after a scheduled fetch the package only waits; it is applied only after the preview with Apply all. How the policy reaches the devices: Enterprise deployment.

Team packages

What a package contains

Create a package

Sign a package

Distribute a package

Review and apply

Policy for team packages

See also

Sources on this page

Short answers.

Ten tabs too many? Talk to us.