diff --git a/.eslintrc.json b/.eslintrc.json
index cdfa1779..d86aea54 100644
--- a/.eslintrc.json
+++ b/.eslintrc.json
@@ -33,14 +33,17 @@
         "commitmentsKey": true,
         "committedNavigation": true,
         "CONFIG_ID": true,
+        "CONFIGURATION_URL": true,
         "countStoredTokens": true,
         "createShake256": true,
         "dev": true,
+        "extVersion": true,
         "futureReload": true,
         "GenerateNewTokens": true,
         "getActiveECSettings": true,
         "getBigNumFromBytes": true,
         "getVerificationKey": true,
+        "getConfigForId": true,
         "getConfigId": true,
         "getConfigName": true,
         "getCurvePoints": true,
@@ -65,6 +68,7 @@
         "patternToRegExp": true,
         "PEM": true,
         "PPConfigs": true,
+        "processConfigPatches": true,
         "processHeaders": true,
         "processRedirect": true,
         "redeemMethod": true,
@@ -73,6 +77,7 @@
         "reloadTabForCookie": true,
         "requestIdentifiers": true,
         "resetSpendVars": true,
+        "retrieveConfiguration": true,
         "sec1DecodeFromBase64": true,
         "sec1DecodeFromBytes": true,
         "sec1EncodeToBase64": true,
@@ -98,9 +103,12 @@
         "updateBrowserTab": true,
         "UpdateCallback": true,
         "updateIcon": true,
+        "validConfigIds": true,
         "validRedemptionMethods": true,
-        "verifyCommitments": true,
-        "verifyProof": true
+        "verifyConfiguration": true,
+        "verifyProof": true,
+        "xhrDone": true,
+        "xhrGoodStatus": true
     },
     "rules": {
         "new-cap": 0,
diff --git a/Makefile b/Makefile
index 767df086..5801351e 100644
--- a/Makefile
+++ b/Makefile
@@ -1,14 +1,15 @@
 SOURCES= src/crypto/keccak/keccak.js \
 		 src/crypto/local.js         \
+         src/ext/config.js           \
          src/ext/background.js       \
          src/ext/browserUtils.js     \
-         src/ext/config.js           \
          src/ext/h2c.js              \
          src/ext/issuance.js         \
          src/ext/redemption.js       \
          src/ext/tokens.js           \
 		 src/ext/utils.js
 LISTENER=src/ext/listeners.js
+INIT=src/ext/init.js
 ASN1_PATH=src/crypto/asn1
 SJCL_PATH=src/crypto/sjcl
 
@@ -51,7 +52,7 @@ dist: build
 	zip -r ext.zip ./dist
 	rm -rf ./dist
 
-addon/build.js: ${ASN1_PATH}/asn1-parser.js ${SJCL_PATH}/sjcl.js ${SOURCES} ${LISTENER}
+addon/build.js: ${ASN1_PATH}/asn1-parser.js ${SJCL_PATH}/sjcl.js ${SOURCES} ${INIT} ${LISTENER}
 	cat $^ > $@
 addon/test.js: ${ASN1_PATH}/asn1-parser.js ${SJCL_PATH}/sjcl.js ${SOURCES}
 	cat $^ > $@
diff --git a/addon/manifest.json b/addon/manifest.json
index 32dc631f..c14d6ac9 100644
--- a/addon/manifest.json
+++ b/addon/manifest.json
@@ -1,5 +1,4 @@
 {
-
   "description": "Handles passes containing cryptographically blinded tokens for bypassing internet challenge.",
   "manifest_version": 2,
   "name": "Privacy Pass",
@@ -7,13 +6,11 @@
   "icons": {
     "48": "icons/ticket-48.png"
   },
-
   "background": {
     "scripts": [
         "build.js"
     ]
   },
-
   "permissions": [
     "alarms",
     "cookies",
@@ -24,11 +21,9 @@
     "webRequestBlocking",
     "webNavigation"
   ],
-
   "browser_action": {
     "default_icon": "icons/ticket-empty-32.png",
     "default_title": "Privacy Pass",
     "default_popup": "popup/bc-plugin.html"
   }
-
 }
diff --git a/addon/popup/bc-plugin.html b/addon/popup/bc-plugin.html
index 275a1ff3..4bed31e4 100644
--- a/addon/popup/bc-plugin.html
+++ b/addon/popup/bc-plugin.html
@@ -10,7 +10,7 @@
   <div id="popup-http" class="popup-http">
     <div class="header">
       <span><img id="privacypass" src="../icons/ticket-1.svg"></span>
-      <h1>Privacy Pass<br><font size="1">Version 2.0.5</font></h1>
+      <span id="header-text"></span>
     </div>
 
     <script src="bc-plugin.js"></script>
diff --git a/addon/popup/bc-plugin.js b/addon/popup/bc-plugin.js
index ce108102..e16d9154 100644
--- a/addon/popup/bc-plugin.js
+++ b/addon/popup/bc-plugin.js
@@ -8,10 +8,18 @@
 let background = chrome.extension.getBackgroundPage();
 if (background) {
     background.UpdateCallback = UpdatePopup;
+    // update version text
+    document.getElementById("header-text").innerHTML = `<h1>Privacy Pass<br><font size="1">Version ${background.extVersion()}</font></h1>`;
 } else {
     browser.runtime.sendMessage({
         callback: UpdatePopup,
     });
+    // update version text
+    browser.runtime.sendMessage({
+        version: true,
+    }).then((extVersion) => {
+        document.getElementById("header-text").innerHTML = `<h1>Privacy Pass<br><font size="1">Version ${extVersion}</font></h1>`;
+    });
 }
 
 /**
diff --git a/docs/CONFIG.md b/docs/CONFIG.md
index 6eeab798..3d975e8d 100644
--- a/docs/CONFIG.md
+++ b/docs/CONFIG.md
@@ -1,22 +1,23 @@
 # Privacy Pass configuration
 
-Privacy Pass uses cryptographic tokens to bypass internet challenges from
-certain providers. In this doc, we discuss the configuration file that Privacy
-Pass uses for interpreting when tokens should be sent for signing/redemption.
-See `src/ext/config.js` for an example configuration `exampleConfig`
-describing the correct format of the JSON struct.
+Privacy Pass uses cryptographic tokens to bypass internet challenges
+from certain providers. In this doc, we discuss the configuration file
+that Privacy Pass uses for interpreting when tokens should be sent for
+signing/redemption. See `src/ext/config.js` for an example configuration
+`exampleConfig` describing the correct format of the JSON struct.
 
 ## config.js
 
-Holds the various configurations as JavaScript JSON structs for the providers
-that Privacy Pass interacts with. Currently, only the Cloudflare and hCaptcha configs are
-active. There is an example config. In the following we will highlight how each config
-field is used.
+Holds the various configurations as JavaScript JSON structs for the
+providers that Privacy Pass interacts with. Currently, only the
+Cloudflare and hCaptcha configs are active. There is an example config.
+In the following we will highlight how each config field is used.
 
 ### config\["id"\]
 
-A unique identifier highlighting which config is used. Currently cfConfig.id =
-1 and hcConfig.id = 2, all other configs must be added with unique "id" values.
+A unique identifier highlighting which config is used. Currently
+`cfConfig.id = 1` and `hcConfig.id = 2`, all other configs must be added
+with unique "id" values.
 
 ### config\["sign"\]
 
@@ -29,20 +30,20 @@ A bool dictating whether Privacy Pass should send tokens for redemption.
 ### config\["max-spends"\]
 
 The integer number of tokens that should be redeemed per host in each
-interaction. This prevents Privacy Pass from repeatedly spending tokens for the
-same host (if some unknown issues occur, for example).
+interaction. This prevents Privacy Pass from repeatedly spending tokens
+for the same host (if some unknown issues occur, for example).
 
 ### config\["max-tokens"\]
 
-The integer number of tokens that should be held by Privacy Pass at any one
-time.
+The integer number of tokens that should be held by Privacy Pass at any
+one time.
 
 ### config\["var-reset"\]
 
-A bool dictating whether the set of variables holding previous redemption
-information should be reset (see resetVars() in background.js). We recommend
-this is set to true, since these variables prevent tokens from being spent in
-the future.
+A bool dictating whether the set of variables holding previous
+redemption information should be reset (see resetVars() in
+background.js). We recommend this is set to true, since these variables
+prevent tokens from being spent in the future.
 
 ### config\["var-reset-ms"\]
 
@@ -55,11 +56,12 @@ are retrieved over HTTP.
 
 ### config\["commitments"\]
 
-Hex-encoded elliptic curve commitment values for verifying DLEQ proofs. These
-essentially amount to public keys issued by the provider. The values of "G" and
-"H" held in config\["commitments"\]\["dev"\] should be used for development
-purposes. Those held in config\["commitments"\]\[<version>\] should be used in the
-production environment.
+Hex-encoded elliptic curve commitment values for verifying DLEQ proofs.
+These essentially amount to public keys issued by the provider. The
+values of "G" and "H" held in `config["commitments"]["dev"]` should be
+used for development purposes. Those held in
+`config["commitments"][<version>]` should be used in the production
+environment.
 
 ### config\["spending-restrictions"\]
 
@@ -67,47 +69,49 @@ A JSON struct of restrictions for redeeming tokens
 
 #### config\["spending-restrictions"\]\["status-code"\]
 
-An integer corresponding to the status code returned by the server. This HTTP
-status code is checked before a redemption is initiated, for Cloudflare this
-value is set to 403. That is, token redemptions can only occur after a HTTP
-response with status code 403 is received. For hCaptcha the code is 200, however
-only hCaptcha specific URLs are eligible for the spend.
+An integer corresponding to the status code returned by the server. This
+HTTP status code is checked before a redemption is initiated, for
+Cloudflare this value is set to 403. That is, token redemptions can only
+occur after a HTTP response with status code 403 is received. For
+hCaptcha the code is 200, however only hCaptcha specific URLs are
+eligible for the spend.
 
 #### config\["spending-restrictions"\]\["max-redirects"\]
 
-An integer dictating the number of times that tokens should be spent after
-requests have been redirected. That is, consider a HTTP response that Privacy
-Pass deems suitable to initiate a redemption. This number indicates how may
-redemption HTTP requests will be tolerated where the response from the server
-results in HTTP redirection.
+An integer dictating the number of times that tokens should be spent
+after requests have been redirected. That is, consider a HTTP response
+that Privacy Pass deems suitable to initiate a redemption. This number
+indicates how may redemption HTTP requests will be tolerated where the
+response from the server results in HTTP redirection.
 
 #### config\["spending-restrictions"\]\["new-tabs"\]
 
-An array of strings indicating that the tab that is open corresponds to a new
-tab (and thus token redemption should not occur).
+An array of strings indicating that the tab that is open corresponds to
+a new tab (and thus token redemption should not occur).
 
 #### config\["spending-restrictions"\]\["bad-navigation"\]
 
-An array of strings corresponding to chrome.webNavigation methods that indicate
-navigation types where tokens should not be redeemed. In the case of Cloudflare,
-this is limited to `auto_subframe` navigations that are not used for Cloudflare
-CAPTCHAs.
+An array of strings corresponding to chrome.webNavigation methods that
+indicate navigation types where tokens should not be redeemed. In the
+case of Cloudflare, this is limited to `auto_subframe` navigations that
+are not used for Cloudflare CAPTCHAs.
 
 #### config\["spending-restrictions"\]\["bad-transition"\]
 
-Similar to above, except for transition types. For Cloudflare, we rule out
-redemption requests when `server_redirect` is the transition type.
+Similar to above, except for transition types. For Cloudflare, we rule
+out redemption requests when `server_redirect` is the transition type.
 
 #### config\["spending-restrictions"\]\["valid-redirects"\]
 
-An array of strings indicating the URL redirections that are tolerated when
-tokens are being redeemed. For example, redemptions that upgrade HTTP
-connections to HTTPS connections.
+An array of strings indicating the URL redirections that are tolerated
+when tokens are being redeemed. For example, redemptions that upgrade
+HTTP connections to HTTPS connections.
 
 #### config\["spending-restrictions"\]\["valid-transitions"\]
 
-An array of strings indicating the transition types that are definitely valid,
-when considering whether redemption requests should be sanctioned.
+An array of strings indicating the transition types that are definitely
+valid, when considering whether redemption requests should be
+sanctioned.
 
 ### config\["spend-action"\]
 
@@ -115,16 +119,17 @@ A JSON struct of configuration related to redeeming tokens.
 
 #### config\["spend-action"\]\["urls"\]
 
-URLs that activate WebRequest listeners for redemption, "`<all_urls>`" corresponds to matching
-all possible URLs.
+URLs that activate WebRequest listeners for redemption, "`<all_urls>`"
+corresponds to matching all possible URLs.
 
 #### config\["spend-action"\]\["redeem-method"\]
 
 A string that determines the method that token redemptions are handled.
-Currently the only supported methods are `"reload"` and `"no-reload"``. `"reload"` method
-redeemeds tokens by reloading the page and appending tokens to the subsequent
-HTTP request. `"no-reload"` method sends tokens with the initial HTTP request that is supposed
-to fetch the captcha itself.
+Currently the only supported methods are `"reload"` and `"no-reload"`.
+`"reload"` method redeems tokens by reloading the page and appending
+tokens to the subsequent HTTP request. `"no-reload"` method sends tokens
+with the initial HTTP request that is supposed to fetch the captcha
+itself.
 
 #### config\["spend-action"\]\["header-name"\]
 
@@ -132,24 +137,26 @@ The name of the header that contains a token for redemption.
 
 #### config\["spend-action"\]\["header-host-name"\]
 
-The name of the header that contains a hostname that is sending the redemption request.
+The name of the header that contains a hostname that is sending the
+redemption request.
 
 #### config\["spend-action"\]\["header-path-name"\]
 
-The name of the header that contains a path that is sending the redemption
-request.
+The name of the header that contains a path that is sending the
+redemption request.
 
 #### config\["spend-action"\]\["empty-resp-headers"\]
 
-If an empty set of response headers is received with the correct status code (as
-defined in `config\["spending-restrictions"\]\["status-code"\]`) then this object
-contains an array of strings that correspond to possible ways of acquiring the
-headers. Currently we only support `"direct-request"`, which sends a direct
-request to the same URL with a specific endpoint attached as defined in
-`config\["opt-endpoints"\]\["challenge"\]`.
+If an empty set of response headers is received with the correct status
+code (as defined in `config["spending-restrictions"]["status-code"]`)
+then this object contains an array of strings that correspond to
+possible ways of acquiring the headers. Currently we only support
+`"direct-request"`, which sends a direct request to the same URL with a
+specific endpoint attached as defined in
+`config["opt-endpoints"]["challenge"]`.
 
-This option was introduced to mitigate problems with Chrome in conjunction with
-sub-resources hosted on separate Cloudflare domains.
+This option was introduced to mitigate problems with Chrome in
+conjunction with sub-resources hosted on separate Cloudflare domains.
 
 ### config\["issue-action"\]
 
@@ -157,8 +164,8 @@ A JSON struct of configuration related to issuing tokens.
 
 #### config\["issue-action"\]\["urls"\]
 
-URLs that activate WebRequest listeners for issuance, "`<all_urls>`" corresponds to matching
-all possible URLs.
+URLs that activate WebRequest listeners for issuance, "`<all_urls>`"
+corresponds to matching all possible URLs.
 
 #### config\["issue-action"\]\["sign-reload"\]
 
@@ -167,32 +174,35 @@ successfully signed.
 
 #### config\["issue-action"\]\["sign-resp-format"\]
 
-Format of the response (as a string) to a signing request. Currently, support
-"string" or "json". When "string" is used, expect the signed tokens to be
-included (base-64 encoded) in the HTTP response body in the form `signatures= ||
-<signed-tokens> || <Batch-DLEQ-Resp>`. When "json" is used, expect the signed
-tokens to be included (base-64 encoded) as a JSON struct with key: "signatures"
-and value `<signed-tokens> || <Batch-DLEQ-Resp>`.
+Format of the response (as a string) to a signing request. Currently,
+support "string" or "json". When "string" is used, expect the signed
+tokens to be included (base-64 encoded) in the HTTP response body in the
+form `signatures= || <signed-tokens> || <Batch-DLEQ-Resp>`. When "json"
+is used, expect the signed tokens to be included (base-64 encoded) as a
+JSON struct with key: "signatures" and value `<signed-tokens> ||
+<Batch-DLEQ-Resp>`.
 
 #### config\["issue-action"\]\["tokens-per-request"\]
 
-The integer number of tokens that should be sent with each signing request. For
-Cloudflare, there is also a server-side upper bound of 100 tokens for each
-signing request. We recommend that this is enforced to prevent unlimited numbers
-of tokens being signed.
+The integer number of tokens that should be sent with each signing
+request. For Cloudflare, there is also a server-side upper bound of 100
+tokens for each signing request. We recommend that this is enforced to
+prevent unlimited numbers of tokens being signed.
 
 #### config\["issue-action"\]\["request-identifiers"\]
 
-An object containing optional identifying characteristics of requests. Requests
-identified using these characteristics can be augmented with data required for
-the issuance portion of the Privacy Pass protocol.
+An object containing optional identifying characteristics of requests.
+Requests identified using these characteristics can be augmented with
+data required for the issuance portion of the Privacy Pass protocol.
 
 For example, the CF config (id=1) uses the following parameters:
 
-- `"query-param"`: for identifying requests based on the URL query parameters
-- `"body-param"`: for replaying important parameters that part of the request body
-- `"post-processed"`: for identifying requests that have already been processed by
-the WebRequest API
+- `"query-param"`: for identifying requests based on the URL query
+  parameters
+- `"body-param"`: for replaying important parameters that part of the
+  request body
+- `"post-processed"`: for identifying requests that have already been
+  processed by the WebRequest API
 
 ### config\["cookies"\]
 
@@ -200,26 +210,28 @@ A JSON struct of configuration related to cookie management.
 
 #### config\["cookies"\]\["check-cookies"\]
 
-A boolean value that determines cookies should be checked before tokens are sent
-for redemption. That is, a token is not redeemed if the browser has a clearance
-cookie for the URL that redemption occurring for.
+A boolean value that determines cookies should be checked before tokens
+are sent for redemption. That is, a token is not redeemed if the browser
+has a clearance cookie for the URL that redemption occurring for.
 
 #### config\["cookies"\]\["clearance-cookie"\]
 
-A string that specifies the specific name of the type of clearance cookie used
-by the provider. In the case of Cloudflare, this is `"cf_clearance"`.
+A string that specifies the specific name of the type of clearance
+cookie used by the provider. In the case of Cloudflare, this is
+`"cf_clearance"`.
 
 ### config\["captcha-domain"\]
 
-A string specifying a domain where users can obtain signed tokens by solving a
-challenge/CAPTCHA. This is helpful to allow users to build up initial stockpiles
-of tokens before they browse.
+A string specifying a domain where users can obtain signed tokens by
+solving a challenge/CAPTCHA. This is helpful to allow users to build up
+initial stockpiles of tokens before they browse.
 
 ### config\["get-more-passes-url"\]
 
-A valid URL string specifying an URL where users can get more signed tokens by solving a
-challenge/CAPTCHA. This URL is pulled into the pop-up `Get more passes` menu item.
-Can be different from `captcha-domain`, and must be a valid URL with protocol specified.
+A valid URL string specifying an URL where users can get more signed
+tokens by solving a challenge/CAPTCHA. This URL is pulled into the
+pop-up `Get more passes` menu item. Can be different from
+`captcha-domain`, and must be a valid URL with protocol specified.
 
 ### config\["opt-endpoints"\]
 
@@ -231,41 +243,133 @@ A JSON struct of configuration related to error codes.
 
 #### config\["error-codes"\]\["verify-error"\]
 
-String error code that the server returns if token redemption fails due to a
-signature verification error.
+String error code that the server returns if token redemption fails due
+to a signature verification error.
 
 #### config\["error-codes"\]\["connection-error"\]
 
-String error code that the server returns if an internal connection error occurs
-server-side.
+String error code that the server returns if an internal connection
+error occurs server-side.
 
 ### config\["h2c-params"\]
 
-A JSON struct of parameters for the curve setting that the client uses. These
-settings are sent to the server with all redemption requests.
+A JSON struct of parameters for the curve setting that the client uses.
+These settings are sent to the server with all redemption requests.
 
 #### config\["h2c-params"\]\["curve"\]
 
-A string that defines the elliptic curve that is being used for mapping tokens
-to. Currently we only support the NIST curve P256, this is represented by the
-string "p256".
+A string that defines the elliptic curve that is being used for mapping
+tokens to. Currently we only support the NIST curve P256, this is
+represented by the string "p256".
 
 #### config\["h2c-params"\]\["hash"\]
 
-The actual hash function that is used for hashing bytes to the base field of the
-curve. Currently we only support the usage of the SHA256 hash function, using
-the string "sha256".
+The actual hash function that is used for hashing bytes to the base
+field of the curve. Currently we only support the usage of the SHA256
+hash function, using the string "sha256".
 
 #### config\["h2c-params"\]\["method"\]
 
-The hash-to-curve method that is used for moving field elements to curve points.
-If it is set to "increment" then we use the hash-and-increment method
-that will be deprecated moving forward. If it is set to "swu", then we use the
-affine version of the SWU algorithm implemented in h2c.js (see
-\[HASH_TO_CURVE.md\](docs/HASH_TO_CURVE.md) for a description of the algorithm in
-full).
+The hash-to-curve method that is used for moving field elements to curve
+points. If it is set to "increment" then we use the hash-and-increment
+method that will be deprecated moving forward. If it is set to "swu",
+then we use the affine version of the SWU algorithm implemented in
+h2c.js (see [HASH_TO_CURVE](HASH_TO_CURVE.md) for a
+description of the algorithm in full).
 
 ### config\["send-h2c-params"\]
 
-A boolean that determines whether the contents of `config["h2c-params"]` should
-actually be sent to the server.
+A boolean that determines whether the contents of `config["h2c-params"]`
+should actually be sent to the server.
+
+## Patching configurations
+
+Configurations can be patched by adding patches to the configuration
+available at <https://github.com/privacypass/ec-commitments>. This
+allows external configuration changes to be made without requiring an
+extension update. A patch blob must be signed with the secret key
+corresponding to the public available at `config["comm-vk"]`.
+
+Previously, the configuration available at the URL above looks something
+like:
+
+```json
+"CF": {
+    "1.0": {
+        // ...
+    },
+    "1.01": {
+        // ...
+    },
+    // more ...
+}
+```
+
+Adding patches to the `"CF"` would require adding a `"patches"` field to
+take the following form:
+
+```json
+"CF": {
+    "patches": [
+        {
+            "min-version": "2.0.0",
+            "config": {
+                // example patched fields
+                "captcha-domain": "new-domain",
+                "spend-action": {
+                    "urls": ["https://some.example.com"],
+                    "header-name": "new-header",
+                },
+                // more fields ...
+            },
+            "sig": "<signature_value>"
+        },
+        {
+            "min-version": "x.y.z",
+            "config": {
+                // patched fields
+            },
+            "sig": "<signature_value>"
+        }
+    ],
+    "1.0": {
+        // ...
+    },
+    "1.01": {
+        // ...
+    },
+    ...
+}
+```
+
+In other words, `patches` is an array containing multiple configuration
+patches, each corresponding to a minimum version of the extension and a
+signature. The `sig` value is an ECDSA signature computed over the
+contents of the `config` and `min-version` members. When patches are
+specified in the external configuration, they must come with a valid
+signature to be accepted as modifications to the base config specified
+in the extension.
+
+Patches are only permitted for the following configuration members:
+```
+[
+    "max-spends",
+    "max-tokens",
+    "var-reset",
+    "var-reset-ms",
+    "spending-restrictions",
+    "spend-action",
+    "issue-action",
+    "cookies",
+    "captcha-domain",
+    "get-more-passes-url",
+    "opt-endpoints",
+    "error-codes",
+    "h2c-params",
+    "send-h2c-params",
+]
+```
+Patches for other members will be rejected.
+
+For further examples of how to patch configurations, see
+`config.test.js`.
diff --git a/jest/globals.js b/jest/globals.js
index 27a2e47f..8f9ef655 100644
--- a/jest/globals.js
+++ b/jest/globals.js
@@ -94,6 +94,8 @@ window.workflowSet = () => {
 
     const PEM = workflow.__get__("exports.PEM");
     const ASN1 = workflow.__get__("exports.ASN1");
+    window.PEM = PEM;
+    window.ASN1 = ASN1;
     workflow.__set__("PEM", PEM);
     workflow.__set__("ASN1", ASN1);
 
@@ -351,12 +353,12 @@ window.goodResponses = [
     },
     {
         string: `signatures=eyJzaWdzIjpbIkJEcTF6TGFRMkVUY3Q0Q3kyZVdSSnRZcnlGTzZBYkxET2JvY0czakFQa3RxM0ZRQzkzbjhLZlk1N2NFNEFTOE9ZWllPRjRTWE96ZjRaT1RjaXJ2R2pncz0iLCJCR1IrR3JlVWF4REJ3Y2t0MHpQaS9KNlQ2Ri9lOVpPYjh2TjJyb1dTU0ZFK0ROa1JGZVNNYUZMWTNSYzVWcTdIcUJRQncvWTZFemswaVkwWGZ5b2pmdXM9Il0sInByb29mIjoiWW1GMFkyZ3RjSEp2YjJ
-            ZOWV5SlFJam9pWlhsS1JFbHFiMmxTV0VaUlZHcEpNRkZVU1hkUFIwWnlUbXBvUWxreWJIcFVSVFZPWld0YWMyVkhZelJpTTJSd1ZGaG9VMVpzVGt0Uk1FMHlUVWR3VUZsNk1HbE1RMHBUU1dwdmFWcFVSa1ZsUldneFRXMHhORk5yY0V0TlEzUkRUWHBvV2xWRWFHcFJNbFY2Vkdwc1NtSkViRWxTUkZaRllUSktlbGR0WkcxWlZtaERWMVF3YVdaUlBUMGlmUT09IiwidmVyc2lvbiI6ImhrZGYiLCJwcm5nIjoiaGtkZiJ9`,
+        ZOWV5SlFJam9pWlhsS1JFbHFiMmxTV0VaUlZHcEpNRkZVU1hkUFIwWnlUbXBvUWxreWJIcFVSVFZPWld0YWMyVkhZelJpTTJSd1ZGaG9VMVpzVGt0Uk1FMHlUVWR3VUZsNk1HbE1RMHBUU1dwdmFWcFVSa1ZsUldneFRXMHhORk5yY0V0TlEzUkRUWHBvV2xWRWFHcFJNbFY2Vkdwc1NtSkViRWxTUkZaRllUSktlbGR0WkcxWlZtaERWMVF3YVdaUlBUMGlmUT09IiwidmVyc2lvbiI6ImhrZGYiLCJwcm5nIjoiaGtkZiJ9`,
         name: "hkdf",
     },
     {
         string: `signatures=eyJzaWdzIjpbIkF6cTF6TGFRMkVUY3Q0Q3kyZVdSSnRZcnlGTzZBYkxET2JvY0czakFQa3RxIiwiQTJSK0dyZVVheERCd2NrdDB6UGkvSjZUNkYvZTlaT2I4dk4ycm9XU1NGRSsiXSwicHJvb2YiOiJZbUYwWTJndGNISnZiMlk5ZXlKUUlqb2laWGxLUkVscWIybFVSR3d3WTJwS2ExVnRlRTFaYlRWMVZGVjRhV0ZHU2xGbFZ6QjNUVzA1VldGWE9WWlRiVkpwVjBaV2FGTXdZM1pSYTF
-            aUlRUQjBWMUpVTUdsTVEwcFRTV3B2YVUxVlNuWlZWR1J6WkRCa1VtRnFSbTFVUjNSU1MzcHNNVm96YjNwVVJXUnlZbGM1YzFsdWJERmlSMVpYVGtoS1ZXVnFUbFJsYkVKSFZGUXdhV1pSUFQwaWZRPT0iLCJ2ZXJzaW9uIjoiaGtkZiIsInBybmciOiJoa2RmIn0=`,
+        aUlRUQjBWMUpVTUdsTVEwcFRTV3B2YVUxVlNuWlZWR1J6WkRCa1VtRnFSbTFVUjNSU1MzcHNNVm96YjNwVVJXUnlZbGM1YzFsdWJERmlSMVpYVGtoS1ZXVnFUbFJsYkVKSFZGUXdhV1pSUFQwaWZRPT0iLCJ2ZXJzaW9uIjoiaGtkZiIsInBybmciOiJoa2RmIn0=`,
         name: "compressed-hkdf",
     },
-];
+];
\ No newline at end of file
diff --git a/src/crypto/local.js b/src/crypto/local.js
index 67876622..cee7a3aa 100644
--- a/src/crypto/local.js
+++ b/src/crypto/local.js
@@ -17,7 +17,7 @@
 /* exported getCurvePoints */
 /* exported getBigNumFromBytes */
 /* exported getActiveECSettings */
-/* exported verifyCommitments */
+/* exported verifyConfiguration */
 /* exported shake256 */
 "use strict";
 
@@ -327,7 +327,7 @@ function parseSignaturefromPEM(pemSignature) {
 }
 
 /**
- * Parse a PEM-encoded publick key.
+ * Parse a PEM-encoded public key.
  * @param {string} pemPublicKey - A public key in PEM format.
  * @return {sjcl.ecc.ecdsa.publicKey} a public key for sjcl library.
  */
@@ -346,23 +346,22 @@ function parsePublicKeyfromPEM(pemPublicKey) {
 }
 
 /**
- * Verify the signature of commitments.
- * @param {json} comms - commitments to verify
- * @param {string} pemPublicKey - A public key in PEM format.
+ * Verify the signature of the retrieved configuration portion.
+ * @param {Number} cfgId - ID of configuration being used.
+ * @param {json} config - commitments to verify
  * @return {boolean} True, if the commitment has valid signature and is not
  *                   expired; otherwise, throws an exception.
  */
-function verifyCommitments(comms, pemPublicKey) {
-    const sig = parseSignaturefromPEM(comms.sig);
-    delete comms.sig;
-    const msg = JSON.stringify(comms);
-    const pk = parsePublicKeyfromPEM(pemPublicKey);
+function verifyConfiguration(cfgId, config) {
+    const sig = parseSignaturefromPEM(config.sig);
+    delete config.sig;
+    const msg = JSON.stringify(config);
+    const pk = parsePublicKeyfromPEM(getVerificationKey(cfgId));
     const hmsg = sjcl.hash.sha256.hash(msg);
-    comms.G = sec1EncodeToBase64(CURVE.G, false);
     try {
         return pk.verify(hmsg, sig);
     } catch (error) {
-        throw new Error("[privacy-pass]: Invalid commitment.");
+        throw new Error("[privacy-pass]: Invalid configuration verification.");
     }
 }
 
diff --git a/src/ext/background.js b/src/ext/background.js
index 220d84b6..e58ea856 100644
--- a/src/ext/background.js
+++ b/src/ext/background.js
@@ -31,10 +31,13 @@
 /* exported getTarget */
 /* exported setFutureReload */
 /* exported getConfigId */
+/* exported getConfigForId */
 /* exported getConfigName */
 /* exported storedCommitments */
 /* exported requestIdentifiers */
 /* exported getMorePassesUrl */
+/* exported xhrDone, xhrGoodStatus */
+/* exported validConfigIds */
 
 "use strict";
 
@@ -43,13 +46,14 @@ let STORAGE_STR = "bypass-tokens-";
 let COUNT_STR = STORAGE_STR + "count-";
 
 // CF config is initialized by default
-let CF_CONFIG_ID = 1;
-let HC_CONFIG_ID = 2;
+const EXAMPLE_ID = 0;
+const CF_CONFIG_ID = 1;
+const HC_CONFIG_ID = 2;
 let CONFIG_ID = CF_CONFIG_ID;
 let getConfigId = () => CONFIG_ID;
 let setConfigId = (val) => CONFIG_ID = val;
 
-let validConfigIds = () => PPConfigs().map((config) => config.id);
+let validConfigIds = () => [EXAMPLE_ID, CF_CONFIG_ID, HC_CONFIG_ID];
 let checkConfigId = (configId) => validConfigIds().includes(configId);
 
 // The active configuration drives the request flow
@@ -564,6 +568,8 @@ function handleMessage(request, sender, sendResponse) {
             // respond with null
             sendResponse();
         }
+    } else if (request.version) {
+        sendResponse(extVersion());
     }
 }
 
@@ -743,3 +749,21 @@ function setConfig(val) {
         countStoredTokens(val);
     }
 }
+
+/**
+ * Checks readystate == 4, this implies a successful response
+ * @param {Number} readystate
+ * @return {boolean}
+ */
+function xhrDone(readystate) {
+    return readystate === 4;
+}
+
+/**
+ * Checks a good HTTP response
+ * @param {Number} status
+ * @return {boolean}
+ */
+function xhrGoodStatus(status) {
+    return status === 200;
+}
diff --git a/src/ext/config.js b/src/ext/config.js
index 2b65e250..50fee88a 100644
--- a/src/ext/config.js
+++ b/src/ext/config.js
@@ -6,13 +6,43 @@
 /* exported DevCommitmentConfig */
 /* exported CHL_BYPASS_SUPPORT */
 /* exported CHL_BYPASS_RESPONSE */
-/* exported activeConfig */
+/* exported CONFIGURATION_URL */
 /* exported PPConfigs */
+/* exported processConfigPatches */
 /* exported validRedemptionMethods */
+/* exported retrieveConfiguration */
+/* exported extVersion */
+
+/**
+ * Returns the version of the extension that is currently running
+ * @return {string} Extension version
+ */
+function extVersion() {
+    return browser.runtime.getManifest().version;
+}
+
+/**
+ * Returns the version of the extension as a separated array
+ * @return {Array<Number>} Extension version
+ */
+function extVersionAsArray() {
+    return versionStringAsNumbers(extVersion());
+}
 
 const CHL_BYPASS_SUPPORT = "cf-chl-bypass"; // header from server to indicate that Privacy Pass is supported
 const CHL_BYPASS_RESPONSE = "cf-chl-bypass-resp"; // response header from server, e.g. with erorr code
 const validRedemptionMethods = () => ["reload", "no-reload"]; // specifies valid token redemption methods
+const CONFIGURATION_URL = "https://raw.githubusercontent.com/privacypass/ec-commitments/master/commitments-p256.json";
+
+// initialise configurations from base settings, and potentially modify
+// with patches later
+let VALID_CONFIGS = [
+    exampleConfig(),
+    cfBaseConfig(),
+    hcBaseConfig(),
+];
+
+let PPConfigs = () => Object.assign([], VALID_CONFIGS);
 
 /**
  * Generates exampleConfig configuration object
@@ -90,13 +120,12 @@ function exampleConfig() {
     };
 }
 
-
 /**
- * Generates array of configuration objects
- * @return {Array} Array of configuration objects
+* Returns the base configuration (without patches) used to integrated
+* with Cloudflare
+* @return {Object} base JSON configuration
  */
-function PPConfigs() {
-    // The configuration used by Cloudflare
+function cfBaseConfig() {
     const cfDomain = "captcha.website";
     const cfConfig = exampleConfig();
     cfConfig.id = 1;
@@ -126,8 +155,15 @@ function PPConfigs() {
     // old version 1.0 commitments for backwards compatibility
     cfConfig["commitments"]["1.0"]["G"] = "BOidEuO9HSJsMZYE/Pfc5D+0ELn0bqhjEef2O0u+KAw3fPMHHXtVlEBvYjE5I/ONf9SyTFSkH3mLNHkS06Du6hQ=";
     cfConfig["commitments"]["1.0"]["H"] = "BHOPNAWXRi4r/NEptOiLOp8MSwcX0vHrVDRXv16Jnowc1eXXo5xFFKIOI6mUp8k9/eca5VY07dBhAe8QfR/FSRY=";
+    return cfConfig;
+}
 
-    // The configuration used by hcaptcha
+/**
+* Returns the base configuration (without patches) used to integrated
+* with hCaptcha
+* @return {Object} base JSON configuration
+ */
+function hcBaseConfig() {
     const hcConfig = exampleConfig();
     hcConfig.id = 2;
     hcConfig.dev = false;
@@ -157,8 +193,185 @@ function PPConfigs() {
             "H": "BNJIpofS4RhbUfnkblr5yvuymaEfV+ViKshsoN9DkCRaHBB+TiKUnicc14gBswpLfBaKXuC102Cvwzq3YIN8dVo=",
         },
     };
+    return hcConfig;
+}
+
+// Top-level configuration keys that can be patched externally
+const PATCHABLE_KEYS = [
+    "max-spends",
+    "max-tokens",
+    "var-reset",
+    "var-reset-ms",
+    "spending-restrictions",
+    "spend-action",
+    "issue-action",
+    "cookies",
+    "captcha-domain",
+    "get-more-passes-url",
+    "opt-endpoints",
+    "error-codes",
+    "h2c-params",
+    "send-h2c-params",
+];
+
+/**
+ * Processes valid patches to the available configurations. This
+ * function is run in init.js
+ * @param {Number} cfgId ID of the configuration being used
+ * @return {XMLHttpRequest} the XHR used to retrieve any patches
+ */
+function processConfigPatches(cfgId) {
+    const callback = (retrieved) => {
+        const patches = retrieved["patches"];
+        if (!patches) {
+            return;
+        } else if (!(patches instanceof Array)) {
+            console.warn("[privacy-pass]: Patches not specified in correct format");
+            return;
+        }
+
+        // process patches if they verify correctly
+        patches.forEach((patch) => {
+            if (!patch || typeof patch !== "object") {
+                console.warn("[privacy-pass]: Patch not specified in correct format");
+                return;
+            }
+
+            // try to verify patch
+            if (!applicablePatch(patch["min-version"])) {
+                console.warn("[privacy-pass]: Patch version criteria not met. Not applying following: " + JSON.stringify(patch, null, 4));
+                return;
+            }
+
+            // check if signature is valid
+            if (patch["sig"] === undefined) {
+                console.warn("[privacy-pass]: Signature field for patch is missing not processing them");
+                return;
+            }
+
+            // error is thrown if bad verification, just ignore if it
+            // fails
+            try {
+                verifyConfiguration(cfgId, patch);
+            } catch (e) {
+                console.warn("[privacy-pass]: Not processing patch as unable to verify signature");
+                return;
+            }
+
+            const config = getConfigForId(cfgId);
+            const patchConfig = patch["config"];
+            Object.keys(patchConfig).forEach((key) => {
+                if (!PATCHABLE_KEYS.includes(key)) {
+                    // do not process patch for non-patchable fields
+                    console.warn(`[privacy-pass]: Patches for ${key} are not permitted`);
+                    return;
+                }
+                const patchValue = patchConfig[key];
+                let current = config[key];
+                switch (typeof current) {
+                    case "object":
+                        if (current !== null) {
+                            Object.assign(current, patchValue);
+                        } else {
+                            current = patchValue;
+                        }
+                        break;
+                    default:
+                        current = patchValue;
+                        break;
+                }
+                config[key] = current;
+            });
+
+            // modify valid configs
+            VALID_CONFIGS[cfgId] = config;
+        });
+    };
+    const xhr = retrieveConfiguration(cfgId, callback);
+    xhr.send();
+    return xhr;
+}
+
+/**
+ * Creates an XMLHttpRequest object to retrieve the active JSON
+ * configuration for the given provider
+ * @param {Number} cfgId ID of configuration to retrieve
+ * @param {Function} callback function to execute after configuration is
+ * retrieved
+ * @return {XMLHttpRequest}
+ */
+function retrieveConfiguration(cfgId, callback) {
+    if (!callback) {
+        throw new Error("[privacy-pass]: Invalid configuration retrieval callback specified");
+    }
+    const xhr = new XMLHttpRequest();
+    xhr.open("GET", CONFIGURATION_URL, true);
+    xhr.setRequestHeader("Accept", "application/json");
+    xhr.onreadystatechange = function() {
+        if (xhrGoodStatus(xhr.status) && xhrDone(xhr.readyState)) {
+            const provider = getConfigName(cfgId);
+            const resp = JSON.parse(xhr.responseText);
+            const config = resp[provider];
+            callback(config);
+        }
+    };
+    return xhr;
+}
+
+/**
+ * Returns the version number (string of form x.y.z) as an array of
+ * three numbers to make comparisons easier
+ * @param {string} version
+ * @return {Array<Number>}
+ */
+function versionStringAsNumbers(version) {
+    return version.split(".").map((s) => parseInt(s));
+}
+
+/**
+ * Compares the version of a patch with that of the extension and
+ * returns true if the min patch version is satisfied.
+ * @param {string} pv Patch version to compare with extension version
+ * @return {boolean}
+ */
+function applicablePatch(pv) {
+    if (!pv) {
+        console.warn("[privacy-pass]: No version specified in patch.");
+        return false;
+    }
+
+    let arr;
+    try {
+        arr = versionStringAsNumbers(pv);
+    } catch (e) {
+        console.warn("[privacy-pass]: Failed to parse patch version.");
+        return false;
+    }
 
-    // Ordering of configs should correspond to value of cf-chl-bypass header
-    // i.e. the first config should have "id": 1, the second "id":2, etc.
-    return [exampleConfig(), cfConfig, hcConfig];
+    // compare version strings
+    const extVersion = extVersionAsArray();
+    if (extVersion[0] < arr[0]) {
+        return false;
+    } else if (extVersion[0] === arr[0]) {
+        if (extVersion[1] < arr[1]) {
+            return false;
+        } else if (extVersion[1] === arr[1]) {
+            if (extVersion[2] < arr[2]) {
+                return false;
+            } else if (
+                // typically versions consist of 3 numbers, but Chrome
+                // supports up to 4 so we should check for this. If the
+                // lengths differ and they are equal up to this point
+                // then just return true.
+                extVersion.length === 4
+                && arr.length === 4
+                && extVersion[2] === arr[2]
+            ) {
+                if (extVersion[3] < arr[3]) {
+                    return false;
+                }
+            }
+        }
+    }
+    return true;
 }
diff --git a/src/ext/init.js b/src/ext/init.js
new file mode 100644
index 00000000..5c1212a2
--- /dev/null
+++ b/src/ext/init.js
@@ -0,0 +1,9 @@
+/**
+ * Any initialisation processes that are required, but which should not
+ * run during the test processes
+ */
+
+// process any patches to the base configurations
+validConfigIds().forEach((id) => {
+    processConfigPatches(id);
+});
diff --git a/src/ext/issuance.js b/src/ext/issuance.js
index 5eda0742..923765cf 100644
--- a/src/ext/issuance.js
+++ b/src/ext/issuance.js
@@ -11,26 +11,7 @@
 
 const ERR_PROOF_VERIFY = new Error("[privacy-pass]: Unable to verify DLEQ proof.");
 
-/**
- * Checks readystate == 4, this implies a successful response
- * @param {Number} readystate
- * @return {boolean}
- */
-function xhrDone(readystate) {
-    return readystate === 4;
-}
-
-/**
- * Checks a good HTTP response
- * @param {Number} status
- * @return {boolean}
- */
-function xhrGoodStatus(status) {
-    return status === 200;
-}
-
 const cachedCommitmentsKey = (id) => `cached-commitments-${id}`;
-const COMMITMENT_URL = "https://raw.githubusercontent.com/privacypass/ec-commitments/master/commitments-p256.json";
 
 /**
  * Constructs an issue request for sending tokens in Cloudflare-friendly format
@@ -337,21 +318,16 @@ function validateAndStoreTokens(url, cfgId, tabId, tokens, issueResp) {
  * @return {XMLHttpRequest} XHR object for verifying server response
  */
 function createVerificationXHR(url, cfgId, tabId, tokens, issueResp, version) {
-    const xhr = new XMLHttpRequest();
-    xhr.open("GET", COMMITMENT_URL, true);
-    xhr.setRequestHeader("Content-Type", "application/json");
-    xhr.onreadystatechange = function() {
-        if (xhrGoodStatus(xhr.status) && xhrDone(xhr.readyState)) {
-            const commitments = retrieveCommitments(cfgId, xhr, version);
-            if (!commitments.G || !commitments.H) {
-                throw new Error("[privacy-pass]: Retrieved commitments are incorrectly specified: " + commitments + ", version: " + version);
-            }
-            // cache commitments since they were verified correctly
-            cacheCommitments(cfgId, version, commitments.G, commitments.H);
-            verifyProofAndStoreTokens(url, cfgId, tabId, tokens, issueResp, commitments);
+    const callback = (config) => {
+        const commitments = retrieveCommitments(cfgId, config, version);
+        if (!commitments.G || !commitments.H) {
+            throw new Error("[privacy-pass]: Retrieved commitments are incorrectly specified: " + commitments + ", version: " + version);
         }
+        // cache commitments since they were verified correctly
+        cacheCommitments(cfgId, version, commitments.G, commitments.H);
+        verifyProofAndStoreTokens(url, cfgId, tabId, tokens, issueResp, commitments);
     };
-    return xhr;
+    return retrieveConfiguration(cfgId, callback);
 }
 
 /**
@@ -398,15 +374,12 @@ function verifyProofAndStoreTokens(url, cfgId, tabId, tokens, issueResp, commitm
  * Retrieves the public commitments that are used for validating the
  * DLEQ proof
  * @param {Number} cfgId config ID driving request
- * @param {XMLHttpRequest} xhr XHR for retrieving the active EC commitments
+ * @param {Object} config JSON config retrieved over HTTP
  * @param {string} version commitment version string
  * @return {Object} Object containing commitment data
  */
-function retrieveCommitments(cfgId, xhr, version) {
-    const resp = JSON.parse(xhr.responseText);
-    const comms = resp[getConfigName(cfgId)];
-
-    const cmt = comms[version];
+function retrieveCommitments(cfgId, config, version) {
+    const cmt = config[version];
     if (typeof cmt === "undefined") {
         throw new Error("[privacy-pass]: Retrieved version: " + version + " not available.");
     }
@@ -417,8 +390,11 @@ function retrieveCommitments(cfgId, xhr, version) {
     if (cmt.sig === undefined) {
         throw new Error("[privacy-pass]: Signature field is missing.");
     }
-    verifyCommitments(cmt, getVerificationKey(cfgId));
-    return {G: cmt.G, H: cmt.H};
+
+    // throws error on bad signature verification
+    verifyConfiguration(cfgId, cmt);
+
+    return {G: sec1EncodeToBase64(getActiveECSettings().curve.G, false), H: cmt.H};
 }
 
 /**
diff --git a/test/config.test.js b/test/config.test.js
index 52f25ba4..463c9bc0 100644
--- a/test/config.test.js
+++ b/test/config.test.js
@@ -37,3 +37,404 @@ each(PPConfigs().filter((config) => config.id > 0).map((config) => [config.id]))
             expect(url === correctValue).toBeTruthy();
         });
     });
+
+// For testing configuration patching
+const MOCK_EXT_VERSION = "2.0.5"; // fixed version for testing
+workflow.__set__("extVersion", () => MOCK_EXT_VERSION);
+const extVersionAsArray = workflow.__get__("extVersionAsArray");
+const testConfigPubKey = "-----BEGIN PUBLIC KEY-----\n" +
+"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE4cdRphWFxgqeSpVRLbtnl66fJNvQ\n" +
+"skXKm9Ww8il9LPp1rZRu2D/VJd95AZ6+1nEagVBeEnRmiOM9P++EOwVfxw==\n" +
+"-----END PUBLIC KEY-----";
+const sig10 = "MEUCIQCJKxh/Ik5jrs47VYBby4OZyXxLxgOhnAkyTmnB//jbiAIgODqfuqjwTrXiRorkdluPpxmYQV2Dz5dXDOXMf3GVzCI=";
+const sig11 = "MEUCIEB5r7N+DKA9vwACSa/HISyWuXUKghGACNxu6a2WTwCFAiEAwFjngF7Z2GEhESBu3pR7J9aEOi1toPJz50/oPDRZWjs=";
+const sig20 = "MEYCIQChW7U+1thCKm3akMkz8903q/4K7gdMIBe95Ev0zrZbDQIhALJZG412wRCrIq4/v8kqDPbAOVeVSSA3p6GQDlwomtvO";
+const sig21 = "MEYCIQDjtv0krYeMO870kjj8aCfGWfe2lUycW8LBxXHZZf6c0gIhALN/KuwR1FCKDAnFq8pKZHDCgpQvaXh4CdRNaEDLTrHo";
+const valid = [
+    {
+        "min-version": "2.0.0",
+        "config": {
+            "spend-action": {
+                "urls": ["https://some.example.com"],
+                "header-name": "new-header",
+            },
+            "issue-action": {
+                "urls": ["https://issue.example.com"],
+                "sign-resp-format": "json",
+                "tokens-per-request": 20,
+                "request-identifiers": {
+                    "body-param": ["new-body-param"],
+                },
+            },
+        },
+        "sig": sig10,
+    },
+    {
+        "min-version": "2.0.0",
+        "config": {
+            "cookies": {
+                "check-cookies": false,
+                "clearance-cookie": "new_cookie_name",
+            },
+            "captcha-domain": "https://new.captcha.domain",
+            "get-more-passes-url": "https://get.more.passes",
+        },
+        "sig": sig11,
+    },
+];
+const arr = extVersionAsArray();
+arr[2] = arr[2]++;
+const validBadVersion = [
+    {
+        "min-version": "2.0.0",
+        "config": {
+            "spend-action": {
+                "urls": ["https://some.example.com"],
+                "header-name": "new-header",
+            },
+            "issue-action": {
+                "urls": ["https://issue.example.com"],
+                "sign-resp-format": "json",
+                "tokens-per-request": 20,
+                "request-identifiers": {
+                    "body-param": ["new-body-param"],
+                },
+            },
+        },
+        "sig": sig10,
+    },
+    {
+        "min-version": `${arr[0]}.${arr[1]}.${arr[2]}`,
+        "config": {
+            "cookies": {
+                "check-cookies": false,
+                "clearance-cookie": "new_cookie_name",
+            },
+            "captcha-domain": "https://new.captcha.domain",
+            "get-more-passes-url": "https://get.more.passes",
+        },
+        "sig": sig11,
+    },
+];
+const validBadPatches = [
+    {
+        "min-version": "2.0.0",
+        "config": {
+            "dev": true,
+            "spend-action": {
+                "urls": ["https://some.example.com"],
+                "header-name": "new-header",
+            },
+            "issue-action": {
+                "urls": ["https://issue.example.com"],
+                "sign-resp-format": "json",
+                "tokens-per-request": 20,
+                "request-identifiers": {
+                    "body-param": ["new-body-param"],
+                },
+            },
+        },
+        "sig": sig20,
+    },
+    {
+        "min-version": "2.0.0",
+        "config": {
+            "id": 4,
+            "cookies": {
+                "check-cookies": false,
+                "clearance-cookie": "new_cookie_name",
+            },
+            "captcha-domain": "https://new.captcha.domain",
+            "get-more-passes-url": "https://get.more.passes",
+        },
+        "sig": sig21,
+    },
+];
+const invalid0 = Object.assign({}, valid[0]);
+invalid0.sig = "BAD/SIG" + sig10;
+const invalid1 = Object.assign({}, valid[1]);
+invalid1.sig = "BAD/SIG" + sig11;
+const invalid = [valid[0], invalid1];
+const validConfigPatch = {
+    "CF": {
+        "patches": valid,
+    },
+    "HC": {
+        "patches": valid,
+    },
+};
+const validConfigPatchBadPatches = {
+    "CF": {
+        "patches": validBadPatches,
+    },
+    "HC": {
+        "patches": validBadPatches,
+    },
+};
+const validConfigPatchBadVersion = {
+    "CF": {
+        "patches": validBadVersion,
+    },
+    "HC": {
+        "patches": validBadVersion,
+    },
+};
+const invalidConfigPatch = {
+    "CF": {
+        "patches": invalid,
+    },
+    "HC": {
+        "patches": invalid,
+    },
+};
+const invalidFormatPatch = {
+    "CF": {
+        "patches": Object.assign({}, valid[0]),
+    },
+    "HC": {
+        "patches": Object.assign({}, valid[0]),
+    },
+};
+
+describe("config patches version tests", () => {
+    const applicablePatch = workflow.__get__("applicablePatch");
+    const extVersion = extVersionAsArray();
+    beforeEach(() => {
+        // have to reset version as we change it in some of the tests
+        workflow.__set__("extVersion", () => MOCK_EXT_VERSION);
+    });
+
+    test("good version", () => {
+        expect(applicablePatch("2.0.0")).toBeTruthy();
+    });
+
+    test("good version, exact", () => {
+        expect(applicablePatch("2.0.5")).toBeTruthy();
+    });
+
+    test("good version, patch version length = 4", () => {
+        expect(applicablePatch("2.0.0.1")).toBeTruthy();
+    });
+
+    test("good version, ext version length = 4", () => {
+        workflow.__set__("extVersion", () => "2.0.5.1");
+        expect(applicablePatch("2.0.0")).toBeTruthy();
+    });
+
+    test("good version, both lengths = 4", () => {
+        workflow.__set__("extVersion", () => "2.0.5.1");
+        expect(applicablePatch("2.0.5.1")).toBeTruthy();
+    });
+
+    test("bad version (0)", () => {
+        const arr = Object.assign([], extVersion);
+        arr[0] = arr[0]++;
+        expect(applicablePatch(arr)).toBeFalsy();
+    });
+
+    test("bad version (1)", () => {
+        const arr = Object.assign([], extVersion);
+        arr[1] = arr[1]++;
+        expect(applicablePatch(arr)).toBeFalsy();
+    });
+
+    test("bad version (2)", () => {
+        const arr = Object.assign([], extVersion);
+        arr[2] = arr[2]++;
+        expect(applicablePatch(arr)).toBeFalsy();
+    });
+
+    test("bad version (3)", () => {
+        workflow.__set__("extVersion", () => "2.0.5.1");
+        expect(applicablePatch("2.0.5.2")).toBeFalsy();
+    });
+});
+
+describe("config patches integration test", () => {
+    const getConfigForId = workflow.__get__("getConfigForId");
+    const processConfigPatches = workflow.__get__("processConfigPatches");
+    const CF_CONFIG_ID = workflow.__get__("CF_CONFIG_ID");
+    const HC_CONFIG_ID = workflow.__get__("HC_CONFIG_ID");
+    const exampleConfig = workflow.__get__("exampleConfig");
+    const cfBaseConfig = workflow.__get__("cfBaseConfig");
+    const hcBaseConfig = workflow.__get__("hcBaseConfig");
+
+    // mocks the XHR for sending to the configuration repo
+    function mockConfigXHRGood() {
+        mockXHR(this);
+        this.status = 200;
+        this.readyState = 4;
+        this.responseText = JSON.stringify(validConfigPatch);
+    }
+    function mockConfigXHRGoodBadPatches() {
+        mockXHR(this);
+        this.status = 200;
+        this.readyState = 4;
+        this.responseText = JSON.stringify(validConfigPatchBadPatches);
+    }
+    function mockConfigXHRGoodBadVersion() {
+        mockXHR(this);
+        this.status = 200;
+        this.readyState = 4;
+        this.responseText = JSON.stringify(validConfigPatchBadVersion);
+    }
+    function mockConfigXHRBadVerify() {
+        mockXHR(this);
+        this.status = 200;
+        this.readyState = 4;
+        this.responseText = JSON.stringify(invalidConfigPatch);
+    }
+    function mockConfigXHRBadFormat() {
+        mockXHR(this);
+        this.status = 200;
+        this.readyState = 4;
+        this.responseText = JSON.stringify(invalidFormatPatch);
+    }
+    function mockConfigXHRBadResp() {
+        mockXHR(this);
+        this.status = 403;
+        this.readyState = 4;
+        this.responseText = JSON.stringify(validConfigPatch);
+    }
+    beforeEach(() => {
+        workflow.__set__("getVerificationKey", () => testConfigPubKey);
+    });
+
+    [CF_CONFIG_ID, HC_CONFIG_ID].forEach((id) => {
+        describe(`test config patches for id: ${id}`, () => {
+            beforeEach(() => {
+                workflow.__set__("VALID_CONFIGS", [exampleConfig(), Object.assign({}, cfBaseConfig()), Object.assign({}, hcBaseConfig())]);
+            });
+
+            test(`process config patches`, () => {
+                workflow.__with__({"CONFIG_ID": id})(() => {
+                    setXHR(mockConfigXHRGood, workflow);
+                    const originalConfig = Object.assign({}, getConfigForId(id));
+                    expect(() => {
+                        const xhr = processConfigPatches(id);
+                        xhr.onreadystatechange();
+                    }).not.toThrow();
+                    expect(consoleMock.warn).not.toHaveBeenCalled();
+                    const newConfig = getConfigForId(id);
+                    expect(newConfig).not.toEqual(originalConfig);
+                    checkPatchesApplied(originalConfig, newConfig);
+                });
+            });
+
+            test(`process config patches with some non-patched values`, () => {
+                workflow.__with__({"CONFIG_ID": id})(() => {
+                    setXHR(mockConfigXHRGoodBadPatches, workflow);
+                    const originalConfig = Object.assign({}, getConfigForId(id));
+                    expect(() => {
+                        const xhr = processConfigPatches(id);
+                        xhr.onreadystatechange();
+                    }).not.toThrow();
+                    expect(consoleMock.warn).not.toHaveBeenCalledWith("[privacy-pass]: Not processing patch as unable to verify signature");
+                    const newConfig = getConfigForId(id);
+                    expect(newConfig).not.toEqual(originalConfig);
+                    checkPatchesApplied(originalConfig, newConfig);
+                    expect(newConfig["id"]).toEqual(originalConfig["id"]);
+                    expect(newConfig["dev"]).toEqual(originalConfig["dev"]);
+                });
+            });
+
+            test(`do not process config patches for bad versions`, () => {
+                workflow.__with__({"CONFIG_ID": id})(() => {
+                    setXHR(mockConfigXHRGoodBadVersion, workflow);
+                    const originalConfig = Object.assign({}, getConfigForId(id));
+                    expect(() => {
+                        const xhr = processConfigPatches(id);
+                        xhr.onreadystatechange();
+                    }).not.toThrow();
+                    expect(consoleMock.warn).toHaveBeenCalledWith("[privacy-pass]: Not processing patch as unable to verify signature");
+                    const newConfig = getConfigForId(id);
+                    checkInvalidPatchesNotApplied(originalConfig, newConfig);
+                });
+            });
+
+            test(`do not process config patches for bad sig`, () => {
+                workflow.__with__({"CONFIG_ID": id})(() => {
+                    setXHR(mockConfigXHRBadVerify, workflow);
+                    const originalConfig = Object.assign({}, getConfigForId(id));
+                    expect(() => {
+                        const xhr = processConfigPatches(id);
+                        xhr.onreadystatechange();
+                    }).not.toThrow();
+                    expect(consoleMock.warn).toHaveBeenCalledWith("[privacy-pass]: Not processing patch as unable to verify signature");
+                    const newConfig = getConfigForId(id);
+                    checkInvalidPatchesNotApplied(originalConfig, newConfig);
+                });
+            });
+
+            test(`do not process config patches for bad formats`, () => {
+                workflow.__with__({"CONFIG_ID": id})(() => {
+                    setXHR(mockConfigXHRBadFormat, workflow);
+                    const originalConfig = Object.assign({}, getConfigForId(id));
+                    expect(() => {
+                        const xhr = processConfigPatches(id);
+                        xhr.onreadystatechange();
+                    }).not.toThrow();
+                    expect(consoleMock.warn).toHaveBeenCalledWith("[privacy-pass]: Patches not specified in correct format");
+                    const newConfig = getConfigForId(id);
+                    expect(newConfig).toEqual(originalConfig);
+                });
+            });
+
+            test(`do not process config patches for bad resp`, () => {
+                workflow.__with__({"CONFIG_ID": id})(() => {
+                    setXHR(mockConfigXHRBadResp, workflow);
+                    const originalConfig = Object.assign({}, getConfigForId(id));
+                    expect(() => {
+                        const xhr = processConfigPatches(id);
+                        xhr.onreadystatechange();
+                    }).not.toThrow();
+                    const newConfig = getConfigForId(id);
+                    expect(newConfig).toEqual(originalConfig);
+                });
+            });
+        });
+    });
+});
+
+function checkPatchesApplied(originalConfig, newConfig) {
+    // check that alll patched values are correct
+    expect(newConfig["spend-action"]["urls"]).toEqual(valid[0]["config"]["spend-action"]["urls"]);
+    expect(newConfig["spend-action"]["header-name"]).toEqual(valid[0]["config"]["spend-action"]["header-name"]);
+    expect(newConfig["issue-action"]["urls"]).toEqual(valid[0]["config"]["issue-action"]["urls"]);
+    expect(newConfig["issue-action"]["sign-resp-format"]).toEqual(valid[0]["config"]["issue-action"]["sign-resp-format"]);
+    expect(newConfig["issue-action"]["tokens-per-request"]).toEqual(valid[0]["config"]["issue-action"]["tokens-per-request"]);
+    expect(newConfig["issue-action"]["request-identifiers"]["body-param"]).toEqual(valid[0]["config"]["issue-action"]["request-identifiers"]["body-param"]);
+    expect(newConfig["cookies"]["check-cookies"]).toEqual(valid[1]["config"]["cookies"]["check-cookies"]);
+    expect(newConfig["cookies"]["clearance-cookie"]).toEqual(valid[1]["config"]["cookies"]["clearance-cookie"]);
+    expect(newConfig["captcha-domain"]).toEqual(valid[1]["config"]["captcha-domain"]);
+    expect(newConfig["get-more-passes-url"]).toEqual(valid[1]["config"]["get-more-passes-url"]);
+
+    checkNonPatchedValues(originalConfig, newConfig);
+}
+
+function checkInvalidPatchesNotApplied(originalConfig, newConfig) {
+    expect(newConfig["spend-action"]["urls"]).toEqual(valid[0]["config"]["spend-action"]["urls"]);
+    expect(newConfig["spend-action"]["header-name"]).toEqual(valid[0]["config"]["spend-action"]["header-name"]);
+    expect(newConfig["issue-action"]["urls"]).toEqual(valid[0]["config"]["issue-action"]["urls"]);
+    expect(newConfig["issue-action"]["sign-resp-format"]).toEqual(valid[0]["config"]["issue-action"]["sign-resp-format"]);
+    expect(newConfig["issue-action"]["tokens-per-request"]).toEqual(valid[0]["config"]["issue-action"]["tokens-per-request"]);
+    expect(newConfig["issue-action"]["request-identifiers"]["body-param"]).toEqual(valid[0]["config"]["issue-action"]["request-identifiers"]["body-param"]);
+
+    // this patch is invalid so nothing should have changed
+    expect(newConfig["cookies"]["check-cookies"]).not.toEqual(valid[1]["config"]["cookies"]["check-cookies"]);
+    expect(newConfig["cookies"]["clearance-cookie"]).not.toEqual(valid[1]["config"]["cookies"]["clearance-cookie"]);
+    expect(newConfig["captcha-domain"]).not.toEqual(valid[1]["config"]["captcha-domain"]);
+    expect(newConfig["get-more-passes-url"]).not.toEqual(valid[1]["config"]["get-more-passes-url"]);
+
+    checkNonPatchedValues(originalConfig, newConfig);
+}
+
+// check that unpatched values are maintained
+function checkNonPatchedValues(originalConfig, newConfig) {
+    expect(newConfig["opt-endpoints"]).toEqual(originalConfig["opt-endpoints"]);
+    expect(newConfig["issue-action"]["request-identifiers"]["query-param"]).toEqual(originalConfig["issue-action"]["request-identifiers"]["query-param"]);
+    expect(newConfig["issue-action"]["request-identifiers"]["post-processed"]).toEqual(originalConfig["issue-action"]["request-identifiers"]["post-processed"]);
+    expect(newConfig["send-h2c-params"]).toEqual(originalConfig["send-h2c-params"]);
+    expect(newConfig["spend-action"]["header-host-name"]).toEqual(originalConfig["spend-action"]["header-host-name"]);
+    expect(newConfig["spend-action"]["header-path-name"]).toEqual(originalConfig["spend-action"]["header-path-name"]);
+}
diff --git a/test/issuance.test.js b/test/issuance.test.js
index aa2b2bda..f69eac6f 100644
--- a/test/issuance.test.js
+++ b/test/issuance.test.js
@@ -30,6 +30,7 @@ const parseIssueResp = workflow.__get__("parseIssueResp");
 const parseSigString = workflow.__get__("parseSigString");
 const setConfig = workflow.__get__("setConfig");
 const getCachedCommitments = workflow.__get__("getCachedCommitments");
+const getConfigName = workflow.__get__("getConfigName");
 const cachedCommitmentsKey = workflow.__get__("cachedCommitmentsKey");
 const cacheCommitments = workflow.__get__("cacheCommitments");
 const checkVersion = workflow.__get__("checkVersion");
@@ -86,36 +87,46 @@ CAPTCHA_KEYS.forEach((captchaKey) => {
 
             test("version not available", () => {
                 const xhr = createVerificationXHR(); // this usually takes params
+                const provider = getConfigName(configId);
+                const config = JSON.parse(xhr.responseText)[provider];
                 expect(
-                    jest.fn(() => retrieveCommitments(configId, xhr, "-1.00")),
+                    jest.fn(() => retrieveCommitments(configId, config, "-1.00")),
                 ).toThrow("Retrieved version");
             });
 
             test("bad public key", () => {
                 const xhr = createVerificationXHR(); // this usually takes params
                 workflow.__set__("getVerificationKey", () => "badPublicKey");
+                const provider = getConfigName(configId);
+                const config = JSON.parse(xhr.responseText)[provider];
                 expect(
-                    jest.fn(() => retrieveCommitments(configId, xhr, "2.0-sig-ok")),
+                    jest.fn(() => retrieveCommitments(configId, config, "2.0-sig-ok")),
                 ).toThrow("Failed on parsing public key");
             });
 
             test("version not available", () => {
                 const xhr = createVerificationXHR(); // this usually takes params
+                const provider = getConfigName(configId);
+                const config = JSON.parse(xhr.responseText)[provider];
                 expect(
-                    jest.fn(() => retrieveCommitments(configId, xhr)),
+                    jest.fn(() => retrieveCommitments(configId, config)),
                 ).toThrow("Retrieved version");
             });
 
             test("parse correctly (v1.0)", () => {
                 const xhr = createVerificationXHR(); // this usually takes params
-                const commitments = retrieveCommitments(configId, xhr, "1.0");
+                const provider = getConfigName(configId);
+                const config = JSON.parse(xhr.responseText)[provider];
+                const commitments = retrieveCommitments(configId, config, "1.0");
                 expect(testG === commitments.G).toBeTruthy();
                 expect(testH === commitments.H).toBeTruthy();
             });
 
             test("parse correctly (sig-ok)", () => {
                 const xhr = createVerificationXHR(); // this usually takes params
-                const commitments = retrieveCommitments(configId, xhr, "2.0-sig-ok");
+                const provider = getConfigName(configId);
+                const config = JSON.parse(xhr.responseText)[provider];
+                const commitments = retrieveCommitments(configId, config, "2.0-sig-ok");
                 expect(testSigG === commitments.G).toBeTruthy();
                 expect(testSigH === commitments.H).toBeTruthy();
             });
@@ -124,7 +135,9 @@ CAPTCHA_KEYS.forEach((captchaKey) => {
                 workflow.__with__({dev: () => true})(() => {
                     const xhr = createVerificationXHR(); // this usually takes params
                     const version = checkVersion(configId, "1.1");
-                    const commitments = retrieveCommitments(configId, xhr, version);
+                    const provider = getConfigName(configId);
+                    const config = JSON.parse(xhr.responseText)[provider];
+                    const commitments = retrieveCommitments(configId, config, version);
                     expect(testDevG === commitments.G).toBeTruthy();
                     expect(testDevH === commitments.H).toBeTruthy();
                 });
@@ -132,7 +145,9 @@ CAPTCHA_KEYS.forEach((captchaKey) => {
 
             test("parse correctly (hkdf)", () => {
                 const xhr = createVerificationXHR(); // this usually takes params
-                const commitments = retrieveCommitments(configId, xhr, "hkdf");
+                const provider = getConfigName(configId);
+                const config = JSON.parse(xhr.responseText)[provider];
+                const commitments = retrieveCommitments(configId, config, "hkdf");
                 expect(hkdfG === commitments.G).toBeTruthy();
                 expect(hkdfH === commitments.H).toBeTruthy();
             });
@@ -164,22 +179,28 @@ CAPTCHA_KEYS.forEach((captchaKey) => {
 
             test("malformed commitments signature", () => {
                 const xhr = createVerificationXHR(); // this usually takes params
+                const provider = getConfigName(configId);
+                const config = JSON.parse(xhr.responseText)[provider];
                 expect(
-                    jest.fn(() => retrieveCommitments(configId, xhr, "2.0-sig-bad")),
+                    jest.fn(() => retrieveCommitments(configId, config, "2.0-sig-bad")),
                 ).toThrow("Failed on parsing commitment signature");
             });
 
             test("signature doesn't verify", () => {
                 const xhr = createVerificationXHR(); // this usually takes params
+                const provider = getConfigName(configId);
+                const config = JSON.parse(xhr.responseText)[provider];
                 expect(
-                    jest.fn(() => retrieveCommitments(configId, xhr, "2.0-sig-fail")),
-                ).toThrow("Invalid commitment");
+                    jest.fn(() => retrieveCommitments(configId, config, "2.0-sig-fail")),
+                ).toThrow("Invalid configuration verification");
             });
 
             test("expired commitments", () => {
                 const xhr = createVerificationXHR(); // this usually takes params
+                const provider = getConfigName(configId);
+                const config = JSON.parse(xhr.responseText)[provider];
                 expect(
-                    jest.fn(() => retrieveCommitments(configId, xhr, "2.0-expired")),
+                    jest.fn(() => retrieveCommitments(configId, config, "2.0-expired")),
                 ).toThrow("Commitments expired in");
             });
         });