Minimal Permissions in MV3 for Storage Extensions

Last updated:

Keep permissions minimal to speed up review and build user trust. This post explains why R2 Dashboard uses only storage, alarms, downloads, offscreen, and specific host permissions for Cloudflare API and R2 endpoints.

storage

Persist accounts, settings, and cache locally with chrome.storage.local for fast, offline-friendly UX.

alarms

Schedule background sync and daily snapshot summaries without keeping UI pages open.

downloads

Use chrome.downloads.download to start file downloads from presigned URLs.

offscreen

Parse large S3 XML using a DOM context unavailable to service workers.

Host permissions

Restrict host access to api.cloudflare.com and *.r2.cloudflarestorage.com only.