1. Mozilla
  2. Add-ons
  3. Browser extensions
  4. manifest.json
  5. permissions
View on MDN

permissions

Type Array
Mandatory No
Manifest version 2 or higher
Example
json
"permissions": [
  "webRequest"
]

Use the permissions key to request special powers for your extension. This key is an array of strings, each of which is a permission request.

If you request permissions using this key, the browser may inform the user at install time that the extension is requesting certain privileges and ask them to confirm they are happy to grant privileges. The browser may also allow the user to inspect an extension's privileges after installation. As requesting privileges may impact users' willingness to install your extension, it's worth careful consideration. For example, avoid requesting unnecessary permissions and explain why you are requesting permissions in your extension's store description. For more information on the issues you should consider, see the article Request the right permissions.

For information on how to test and preview permission requests, see Test permission requests on the Extension Workshop site.

The key can contain three kinds of permissions:

Host permissions

Note: How you request host permissions depends on whether you want them at install time or runtime and which manifest version your extension is using.

Host permissions are specified as match patterns, and each pattern identifies a group of URLs for which the extension is requesting extra privileges. For example, a host permission could be "*://developer.mozilla.org/*".

The extra privileges include:

  • XMLHttpRequest and fetch access to those origins without cross-origin restrictions.

    Note: For Manifest V2 extensions in Firefox only, this includes requests made from content scripts.

  • the ability to read tab-specific metadata without the "tabs" permission, such as the url, title, and favIconUrl properties of tabs.Tab objects
  • the ability to inject content scripts and styles programmatically into pages served from those origins.
  • the ability to receive events from the webRequest API for these hosts
  • the ability to access cookies for that host using the cookies API, as long as the "cookies" API permission.
  • bypassing tracking protection for extension pages where a host is specified as a full domain or with wildcards. Content scripts, however, can only bypass tracking protection for hosts specified with a full domain.
  • the ability to create and retrieve WebAuthn credentials. See Use Web Authn API in web extensions for details.

API permissions

You specify API permissions as keywords, and each keyword names a WebExtension API that the extension would like to use.

These permissions are available in Manifest V2 and above unless otherwise noted:

  • activeTab
  • alarms
  • background
  • bookmarks
  • browserSettings
  • browsingData
  • captivePortal
  • clipboardRead
  • clipboardWrite
  • contentSettings
  • contextMenus
  • contextualIdentities
  • cookies
  • debugger
  • declarativeNetRequest
  • declarativeNetRequestFeedback
  • declarativeNetRequestWithHostAccess
  • devtools (This permission is granted implicitly when the devtools_page manifest key is present.)
  • dns
  • downloads
  • downloads.open
  • find
  • geolocation
  • history
  • identity
  • idle
  • management
  • menus
  • menus.overrideContext
  • nativeMessaging
  • notifications
  • pageCapture
  • pkcs11
  • privacy
  • publicSuffix
  • proxy
  • scripting
  • search
  • sessions
  • storage
  • tabGroups
  • tabHide
  • tabs
  • theme
  • topSites
  • unlimitedStorage
  • userScripts (see userScripts permission)
  • webNavigation
  • webRequest
  • webRequestAuthProvider (Manifest V3 and above)
  • webRequestBlocking
  • webRequestFilterResponse
  • webRequestFilterResponse.serviceWorkerScript

In most cases, the permission grants access to the API only, with these exceptions:

activeTab permission

When a user interacts with an extension that has the activeTab permission, the extension is granted extra privileges for the tab where the interaction occurred. This lets an extension act on the current page when the user asks, without requesting broad host permissions.

For details of how the permission is granted, what it enables, when the access ends, and how behavior differs among browsers, see the activeTab permission page.

Clipboard access

Two permissions enable an extension to interact with the clipboard:

clipboardWrite

Write to the clipboard using Clipboard.write(), Clipboard.writeText(), document.execCommand("copy") or document.execCommand("cut").

clipboardRead

Read from the clipboard using Clipboard.read(), Clipboard.readText() or document.execCommand("paste").

See Interact with the clipboard for more details.

Unlimited storage

The unlimitedStorage permission:

  • Enables extensions to exceed any quota imposed by the storage.local API
  • In Firefox, enables extensions to create a "persistent" IndexedDB database without the browser prompting the user for permission at the time the database is created.

Examples

json
 "permissions": ["*://developer.mozilla.org/*"]

In Manifest V2 only, request privileged access to pages under developer.mozilla.org.

json
  "permissions": ["tabs"]

Request access to the privileged pieces of the tabs API.

json
  "permissions": ["*://developer.mozilla.org/*", "tabs"]

In Manifest V2 only, request both of the above permissions.

Browser compatibility

Help improve MDN

Learn how to contribute

This page was last modified on by MDN contributors.

View this page on GitHub • Report a problem with this content