identity

Use this permission when your extension needs to integrate with a service that uses OAuth2, especially Google services.

Examples:

• An extension that saves files to the user's Google Drive.
• A "to-do list" extension that syncs with the user's Google Tasks.
• An extension that displays events from a user's Google Calendar.

{
  "name": "My Google Drive Saver",
  "version": "1.0",
  "manifest_version": 3,
  "permissions": [
    "identity"
  ],
  "oauth2": {
    "client_id": "YOUR_CLIENT_ID.apps.googleusercontent.com",
    "scopes": [
      "https://www.googleapis.com/auth/drive.file"
    ]
  }
}

Why is it risky?

This permission allows an extension to act on your behalf on other websites and services, such as your Google account. When you grant it, you'll see a popup from Google (or another service like Facebook) asking you to approve the extension's access.

This popup will list exactly what the extension wants to do (e.g., "Read and change your Google Calendar events"). If you approve, the extension gets a special key that lets it perform those actions. A malicious extension could use this to:

• Read your private emails or documents.
• Delete your files or calendar events.
• Post on your social media accounts.

Always read the consent popup carefully to see what you are agreeing to. Only grant this permission to extensions from developers you trust.

This example retrieves an OAuth2 token for the Google Drive API.

// background.js

chrome.action.onClicked.addListener(() => {
  chrome.identity.getAuthToken({ interactive: true }, (token) => {
    if (chrome.runtime.lastError) {
      console.error(chrome.runtime.lastError.message);
      return;
    }
    if (token) {
      console.log('Successfully retrieved auth token:', token);
      // You can now use this token to make API requests to Google Drive.
    }
  });
});

For non-Google OAuth providers (GitHub, Microsoft, Facebook, custom IdPs), use launchWebAuthFlow instead. It opens the provider's authorization URL in a controlled window and resolves with the redirect URL once the user finishes signing in.

// background.js — generic OAuth provider

const redirectUri = chrome.identity.getRedirectURL();
const authUrl = new URL('https://github.com/login/oauth/authorize');
authUrl.searchParams.set('client_id', 'YOUR_GITHUB_CLIENT_ID');
authUrl.searchParams.set('redirect_uri', redirectUri);
authUrl.searchParams.set('scope', 'read:user');

chrome.identity.launchWebAuthFlow(
  { url: authUrl.toString(), interactive: true },
  (responseUrl) => {
    if (chrome.runtime.lastError || !responseUrl) {
      console.error(chrome.runtime.lastError?.message ?? 'No redirect.');
      return;
    }
    const code = new URL(responseUrl).searchParams.get('code');
    console.log('Got authorization code:', code);
    // Exchange `code` for an access token via your backend.
  }
);