> ## Documentation Index
> Fetch the complete documentation index at: https://docs.extensy.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Permissions

> Understand Chrome extension permissions, how to request only what you need, and how Extensy keeps your permission footprint minimal.

Before your extension can interact with the browser or any website, it must declare what it needs access to. Chrome's permission system is designed to protect users: the browser shows your requested permissions to anyone who installs your extension, and the Chrome Web Store reviews them before approving your listing.

Extensy automatically requests only the permissions your prompt actually requires — nothing more.

## Two types of permissions

Your `manifest.json` contains two separate permission categories:

> **API permissions**
>
> Grant access to specific Chrome APIs such as `storage`, `tabs`, `scripting`, or `notifications`. Declared in the `"permissions"` array.

> **Host permissions**
>
> Grant access to specific websites or URL patterns. Declared in the `"host_permissions"` array.

## Common API permissions

| Permission | What it unlocks | Risk level | Example use case |
| :- | :- | :- | :- |
| `activeTab` | Access the current tab only when the user clicks the extension icon | Low | Screenshot tools, single-page highlighters |
| `storage` | Store and sync persistent data locally or across devices | Low | Saving user settings, tokens, or theme preferences |
| `tabs` | Read all open tab URLs, titles, and states | Medium | Tab managers, multi-tab trackers |
| `scripting` | Programmatically inject JavaScript or CSS into pages | High | Ad blockers, UI theme changers |
| `alarms` | Schedule periodic callbacks or delayed tasks | Low | Timers, scheduled background jobs |
| `notifications` | Display system-level desktop notifications | Low | Reminders, alerts, background job results |
| `downloads` | Manage and monitor browser downloads | Medium | Download managers, file auto-sorters |
| `cookies` | Read or modify browser cookies for permitted hosts | High | Authentication helpers, session monitors |
| `history` | Access the user's full browsing history | High | Productivity trackers, history dashboards |

## Host permissions

If your extension needs to run on or communicate with a specific website, you must list that site as a host permission.

```json theme={null}
"host_permissions": [
  "https://*.google.com/*",
  "https://example.com/shop/*"
]
```

* `https://*.google.com/*` — All subdomains of google.com
* `https://example.com/shop/*` — Only the `/shop` path on example.com
* `<all_urls>` — Every website the user visits

> [!WARNING]
>
> Requesting `<all_urls>` grants your extension access to every site the user visits. The Chrome Web Store scrutinizes extensions that use it, and users are significantly less likely to install them. If you also request `history` or `cookies`, you are **required** to publish a public privacy policy in your store listing.

> [!NOTE]
>
> Extensy always uses the most restrictive host permission that satisfies your prompt. If you ask for an extension that only runs on Wikipedia, Extensy will request `https://*.wikipedia.org/*` — not `<all_urls>`.

## The least-privilege principle

Always request the minimum permissions your extension needs to function. There are three concrete reasons to do this:

**1. Build user trust**

Users read permission prompts. Fewer permissions means more installs. Extensions that request only `activeTab` feel far less intrusive than ones requesting `tabs` + `history`.

**2. Accelerate CWS review**

Chrome Web Store reviews move significantly faster for extensions with a narrow permission footprint. Broad permissions like `<all_urls>` trigger manual review and can delay publication by days.

**3. Limit blast radius**

If your extension is ever compromised, having fewer permissions limits the damage an attacker can do using your extension's identity.

> [!TIP]
>
> If your extension only needs to act on the page the user is currently viewing — and only when they click your icon — use `activeTab` instead of the broader `tabs` permission. It builds trust and simplifies your store review.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.