extroot: is a config directive for serving CGI extensions in Fossil.
The repo script could contain for example:

#!/usr/bin/fossil
repository: /fossil.d/sqlite.fossil
#directory: /fossil.d/
errorlog: /www/logs/fossil.errors.txt
cgi-debug: /www/logs/fossil.cgi.debug.log
extroot: /fossil.d/extroot

And the extroot/ dir would contain executable/CGI scripts, which then become accesssible as http://fossil.example.org/repo/ext/auth.
See https://fossil.include-once.org/fossil-skins/ext/index for a live view. (Note that all examples here rely on php-cgi; thus probably won't work easily with chroot-jailed fossil setups.)

Note: fossil_common.php is now a required dependency for most scripts.

auth / token

Is a basic IndieAuth authorization_endpoint. Which permits using fossil accounts for federated logins. It requires adding homepage urls either in info column, or per ext/user_config in new homepage field. And then augmenting your personal homepage with:

<link rel=authorization_endpoint href="https://fossil.example.org/repo/ext/auth">
<link rel=token_endpoint href="https://fossil.example.org/repo/ext/token">

Thenceforth you can use one account for logging into various services (via e.g. IndieAuth.com or IndieLogin.com). The protocol is based on OAuth 2.0, but more convenient; it's also the spiritual successor to OpenID.

micropub

Both auth/token are also intended to be used with the publishing API. Which is actually intended for blogging, but here used to submit wiki pages or technotes from an external editor/app. It should be bound on a user homepage or in the repo with:

<link rel=micropub href="https://fossil.example.org/repo/ext/micropub">

The implementation is a bind long-winded, because it prepares for a more general micropub editor.

user_config

Allows logged in users to edit user.info or new user.homepage field. (Both are scanned by auth extension for urls.)

index

Simply lists existing CGI scripts.

sqliteadmin

Is a cgi-prefixed version of phpLiteAdmin, only accessible to admin users (s capability). Which allows some simpler table browsing than /admin_sql. Primarily useful for data tables. Unfortunately you can't limit browsing or queries to elected tables - would be a more useful tool if it could be made accessible to any developer.

crashreport

Basic backend to store application errors/exceptions as tickets. (When submitted as JSON blob per POST request.)

skin

Combines editing of header/footer/css/js/th1-setup for current skin. (Sidesteps draftX publishing, and keeps ample backups instead.)

fx_meta

Generates <meta> twitter card fields for wiki pages. (Was supposed to also embed raw/ <link>s for file browsing, but that's probably better done in a th1 function.)

cat

Is an ext/ version of the /cat/filename.txt shorthand.

config

Allows to set additional project options (utilizes plugin meta data from all scripts).

trees

Emulates GitHub’s trees API.

changelog

Extroot-version of the NEWS-file generator.