---
title: "Chrome 'identity' permission & OAuth tokens in AI browser extensions."
description: "How does `chrome.identity` work in Chrome extensions? Learn the difference between basic email sign-in and broad Google Workspace OAuth scopes (Gmail, Drive, Sheets)."
canonical_url: "https://vezz.me/permissions/identity-and-oauth/"
type: "pseo-permissions"
category: "permissions"
topic: "Chrome Permission Audit"
intent: "Best for users and IT admins reviewing OAuth consent screens and identity permissions in Chrome extensions."
---

# Chrome 'identity' permission & OAuth tokens in AI browser extensions.

How does `chrome.identity` work in Chrome extensions? Learn the difference between basic email sign-in and broad Google Workspace OAuth scopes (Gmail, Drive, Sheets).

> **Best fit:** Best for users and IT admins reviewing OAuth consent screens and identity permissions in Chrome extensions.

## Technical Permission Audit

- **Manifest Key:** `identity / identity.email`
- **Chrome Install Warning:** "Know your email address" (or separate Google OAuth consent screen)
- **Risk Level:** Lower

```json
{
  "manifest_version": 3,
  "permissions": ["identity"]
}
```

### Legitimate Uses
- Authenticating a user's subscription tier without requiring a separate password
- Launching a standard OAuth2 PKCE login flow via `chrome.identity.launchWebAuthFlow`

### Red Flags to Watch For
- Bundling broad Google Drive (`drive`), Gmail (`mail.google.com`), or Contacts OAuth scopes into a simple sign-in prompt

**How Vezz me handles this:** Vezz me does not request OAuth access to your Google Drive, Gmail, or Workspace files. You simply enter your email address in the extension to track your 10 free monthly answers or Pro subscription.

## Step-by-step workflow

1. **Separate Chrome manifest permissions from OAuth scopes**: The `identity` permission in `manifest.json` only enables the auth popup API. The actual data access is determined by the `oauth2.scopes` requested on the consent screen.
2. **Audit every checkbox on Google OAuth screens**: A login screen should only ask for `openid`, `email`, and `profile`—never access to read your Google Drive or Gmail unless that is the core product.

## Why Vezz me uses lightweight email identification

You shouldn't have to connect your Google Workspace OAuth tokens just to ask 10 free AI questions a month.

- Enter any email address in the Vezz me popup to track usage and Pro status
- Zero access to your Google account tokens, contacts, or cloud files
- Subscription billing is handled directly by Stripe

## Frequently asked questions

### Does Vezz me ask for Google OAuth permissions?

No. Vezz me never asks for OAuth access to your Google account.

## Related guides

- [Google Docs & Workspace permissions](https://vezz.me/permissions/google-docs-and-workspace/): How AI Chrome extensions interact with Google Workspace.
- [Google Sheets & report permissions](https://vezz.me/permissions/google-sheets-and-reports/): What permissions AI extensions ask for on spreadsheets.