Using the URL returned by Charles Proxy when installing an extension from the Chrome Web Store to download the extension (inspired by paulirish).
$ extension_id=jifpbeccnghkjeaalbbjmodiffmgedin
$ curl --output "$extension_id.crx" --silent --location "https://clients2.google.com/service/update2/crx?response=redirect&os=mac&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=canary&prodversion=107.0.5304.0&lang=en-GB&acceptformat=crx3&x=id%3D$extension_id%26installsource%3Dondemand%26uc"
$ file "$extension_id.crx"
jifpbeccnghkjeaalbbjmodiffmgedin.crx: Google Chrome extension, version 3
The SHA-256 checksum of the downloaded file matches the value returned by the API.
$ sha256sum "$extension_id.crx"
92c3ce80364f17e54dbc9332021d9368be025bffbbe0a788e055129af2fc6853 jifpbeccnghkjeaalbbjmodiffmgedin.crx
$ curl --silent --location --output "$extension_id.xml" "https://clients2.google.com/service/update2/crx?os=mac&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=canary&prodversion=107.0.5304.0&lang=en-GB&acceptformat=crx3&x=id%3Djifpbeccnghkjeaalbbjmodiffmgedin%26installsource%3Dondemand%26uc"
$ xml sel -N x="http://www.google.com/update2/response" -t -v "//x:updatecheck/@hash_sha256" -n "$extension_id.xml"
92c3ce80364f17e54dbc9332021d9368be025bffbbe0a788e055129af2fc6853
Only response, prodversion, x and acceptformat seem to be mandatory parameters, at least a request with only those results in an identical file.
$ curl --output "$extension_id.crx" --silent --location "https://clients2.google.com/service/update2/crx?response=redirect&prodversion=107.0.5304.0&x=id%3D$extension_id%26uc&acceptformat=crx3"
$ sha256sum "$extension_id.crx"
92c3ce80364f17e54dbc9332021d9368be025bffbbe0a788e055129af2fc6853 jifpbeccnghkjeaalbbjmodiffmgedin.crx
It seems further that prodversion can be any value >= 32.