Plugin architecture for SaaS extensibility: lessons learned?

we're starting to design a plugin architecture for our B2B SaaS platform, aiming for extensibility similar to how Shopify apps work. we want third-party developers to be able to build integrations and custom logic for our customers without us having to build everything ourselves. i'm looking for lessons learned from others who have built similar systems. our current thoughts involve using WebAssembly for sandboxing custom code execution, providing webhooks for event notifications to plugins, and a well-defined REST API for plugins to interact with our platform data. what are the biggest challenges you faced? was it security, performance, developer experience for plugin authors, or managing the lifecycle of plugins? any advice on structuring the APIs and events to make it easy for external developers to build on top of our system?