Skip to main content
Before your extension can interact with the browser or any website, it must declare what it needs access to. Chrome’s permission system is designed to protect users: the browser shows your requested permissions to anyone who installs your extension, and the Chrome Web Store reviews them before approving your listing. Extensy automatically requests only the permissions your prompt actually requires — nothing more.

​
Two types of permissions

Your manifest.json contains two separate permission categories:

API permissions

Grant access to specific Chrome APIs such as storage, tabs, scripting, or notifications. Declared in the "permissions" array.

Host permissions

Grant access to specific websites or URL patterns. Declared in the "host_permissions" array.

​
Common API permissions

​
Host permissions

If your extension needs to run on or communicate with a specific website, you must list that site as a host permission.
  • https://*.google.com/* — All subdomains of google.com
  • https://example.com/shop/* — Only the /shop path on example.com
  • <all_urls> — Every website the user visits
Requesting <all_urls> grants your extension access to every site the user visits. The Chrome Web Store scrutinizes extensions that use it, and users are significantly less likely to install them. If you also request history or cookies, you are required to publish a public privacy policy in your store listing.
Extensy always uses the most restrictive host permission that satisfies your prompt. If you ask for an extension that only runs on Wikipedia, Extensy will request https://*.wikipedia.org/* — not <all_urls>.

​
The least-privilege principle

Always request the minimum permissions your extension needs to function. There are three concrete reasons to do this:
1

Build user trust

Users read permission prompts. Fewer permissions means more installs. Extensions that request only activeTab feel far less intrusive than ones requesting tabs + history.
2

Accelerate CWS review

Chrome Web Store reviews move significantly faster for extensions with a narrow permission footprint. Broad permissions like <all_urls> trigger manual review and can delay publication by days.
3

Limit blast radius

If your extension is ever compromised, having fewer permissions limits the damage an attacker can do using your extension’s identity.
If your extension only needs to act on the page the user is currently viewing — and only when they click your icon — use activeTab instead of the broader tabs permission. It builds trust and simplifies your store review.