Should extension APIs consume user activation?

[oliverdunk]

The User Activation spec defines two relevant types of APIs gated by user activation:

...

• Transient activation-gated APIs
  These APIs require the transient activation state to be true, but they don't consume it, so multiple calls are allowed per user activation until the transient state expires.

• Transient activation-consuming APIs
  These APIs require the transient activation state to be true, and they consume user activation in each call to prevent multiple calls per user activation.

...

Should extension APIs be activation consuming, and if so, should we do these across all APIs or on a case by case basis?

[oliverdunk]

We are supportive of this on the Chrome side and tentatively believe all extension APIs we have today should consume activation.

[nasreenkhannam]

Hello everyone 👋
I’m Nasreen Khan, new to the WebExtensions community.

From my understanding, the core question is whether extension APIs should only work after an explicit user activation (like a click), or whether some APIs can run without consuming activation.

I’d like to contribute to this discussion.
Here are some thoughts:

1. Predictability for users:
   Requiring user activation for sensitive APIs (e.g., opening windows, modifying tabs, clipboard) improves user trust and reduces the chance of unwanted behavior.

2. Developer flexibility:
   Some extension actions (e.g., scheduled background tasks or passive listeners) may need to run without user activation. Making all APIs require activation may break valid workflows.

3. Possible middle ground:

Critical / intrusive APIs → must require user activation

Non-critical APIs → should not require activation

Provide clear documentation of which APIs consume activation

I’m happy to help draft a clearer list of APIs that should consume activation and those that shouldn't.
Please let me know if this direction is useful.

Thank you!

[tophf]

tentatively believe all extension APIs we have today should consume activation

How would you count though a messaging listener that is called by the web page and then makes hundreds of API calls querying the tabs, sync storage, pinging other tabs/frames/contexts to collect the info, possibly make multiple network requests, inject both CSS and JS into the calling tab, possibly using permissions.request()?

[oliverdunk]

tentatively believe all extension APIs we have today should consume activation

How would you count though a messaging listener that is called by the web page and then makes hundreds of API calls querying the tabs, sync storage, pinging other tabs/frames/contexts to collect the info, possibly make multiple network requests, inject both CSS and JS into the calling tab, possibly using permissions.request()?

To clarify, any methods we have today that require user activation (like downloads.open()) should consume that activation. Any other methods should continue to work without user activation and not be consuming.

[nasreenkhannam]

Thanks for the clarification, that makes a lot of sense.

To help move this discussion forward, I'll prepare a small draft document that lists:
• which APIs should consume user activation
• which APIs should not
• and the reasoning behind each category

I'll share it here soon so we can refine it together.

[kiaraarose]

Currently, permissions.request() is the only API in Safari that requires a user gesture