diff --git a/src/manifests/firefox.json b/src/manifests/firefox.json
index 0fb2721..40db0e9 100644
--- a/src/manifests/firefox.json
+++ b/src/manifests/firefox.json
@@ -38,6 +38,7 @@
     "chrome_style": false,
     "page": "options.html"
   },
-  "permissions": ["alarms", "tabs", "storage", "activeTab"],
+  "permissions": ["alarms", "tabs", "storage", "activeTab", "https://api.wakatime.com/*", "https://wakatime.com/*"],
+  "optional_permissions": ["<all_urls>"],
   "version": "4.0.9"
 }
diff --git a/src/utils/settings.ts b/src/utils/settings.ts
index 9e8633d..dffb9f0 100644
--- a/src/utils/settings.ts
+++ b/src/utils/settings.ts
@@ -81,5 +81,10 @@ export const getSettings = async (): Promise<Settings> => {
 };
 
 export const saveSettings = async (settings: Settings): Promise<void> => {
-  return browser.storage.sync.set(settings);
+  // permissions.request must be the first await, not after the browser.storage.sync.set
+  // See https://stackoverflow.com/a/47729896/12601364
+  await browser.permissions.request({
+    origins: [`${settings.apiUrl}/*`],
+  });
+  await browser.storage.sync.set(settings);
 };