Extensions
Extension Signing
Extensions are signed with a cryptographic key, which also simplifies distribution (this is why they are served over HTTP and not HTTPS).
By default, DuckDB uses its built-in public keys to verify the integrity of extension before loading them.
All extensions provided by the DuckDB core team are signed.  
#### Unsigned Extensions {#docs:extensions:overview::unsigned-extensions}  
> **Warning.  ** Only load unsigned extensions from sources you trust. Also, avoid loading them over HTTP.  
If you wish to load your own extensions or extensions from third-parties you will need to enable the `allow_unsigned_extensions` flag.
To load unsigned extensions using the [CLI client](#docs:api:cli:overview), pass the `-unsigned` flag to it on startup:  
```bash
duckdb -unsigned
```  
Now any extension can be loaded, signed or not:  
```sql
LOAD './some/local/ext.duckdb_extension';
```  
For Client APIs, the `allow_unsigned_extensions` database configuration options needs to be set, see the respective [Client API docs](#docs:api:overview).
For example, for the Python client, see the [Loading and Installing Extensions section in the Python API documentation](#docs:api:python:overview::loading-and-installing-extensions).