OAuth Readiness
Back to all apps

Google Gmail

Generated live by the research agent (Gemini), checked 2026-10-19. Setup not tested by hand.

Building an OAuth application to connect external users' Google Gmail accounts requires configuring an external project, registering authorized domains, and completing the verification process if sensitive or restricted scopes are used. Unverified apps are limited to 100 new users in total and feature tokens that expire after seven days.

Tier 3: Review required

Hands-on work
0.5–2 hours
Waiting for approval
0+ days
Confidence
low

Assumes: A public app that any external user can connect, requesting the scopes an AI agent typically needs to read and act on the user's data.

10 min1 hour1 workday1 week1 month6 months

Solid dark bar: your hands-on work. Amber: the minimum wait. Hatched: the range sources disagree on, or an open-ended wait.[1][2]

Biggest blocker: The requirement to verify domains and complete the verification process for application names, logos, and sensitive or restricted scopes.[1][2]

Why tier 3? Set by: provider review. 2 facts unknown, so the tier could be higher.
The tier is computed from these seven facts by a fixed rule, not chosen by the AI. Low: some facts are unknown or rest on forum reports. Verify before you plan around this.
Self-serve credentialsYesDevelopers can create and configure external projects in the Google Cloud platform console.[1]
Limits until reviewedYesTesting projects are limited to up to 100 test users, and authorizations expire seven days from consent.[1]
Provider reviewYesProjects requesting sensitive or restricted scopes should complete the verification process.[1]
Security assessmentUnknownThe sources do not mention security assessments. (no source)
Business verificationUnknownThe sources do not mention business verification. (no source)
Mandatory feesNoNot mentioned in the official process: standard use of the Gmail API is available at no additional cost.[3]
Partner or paid accessNoNot mentioned in the official process: external projects configured with an external user type are available to any user with a Google Account.[1]

You can start today without any of this. Composio already provides a managed OAuth app for Google Gmail (gmail), so users can connect while you work through your own app. You need your own app for your brand on the consent screen, your own rate limits, or scopes beyond the defaults. Managed auth list

If your case is different

Internal Projects
Internal Projects associated with a Google Cloud Organization can configure internal users to limit authorization requests to members of the organization.

Steps

Agent steps an AI agent can do or draft for you. You steps that need your identity, accounts, legal authority or a real demo.

  1. Configure External Project

    Agent

    Set up an external project with a user type of External in the Google Cloud console.[1]

  2. Register Authorized Domains

    Agent

    Specify app domains, home page, privacy policy, and terms of service links, ensuring domains are registered as authorized domains.[2]

  3. Submit App for Verification

    You

    Submit the app for verification if it requests sensitive or restricted scopes or if branding requires verification.[1][2]

  4. Wait for Branding Evaluation

    YouWait

    Wait for the evaluation process for brand verification, which usually completes in a few minutes.[2]

What you will need

  • Provide an app name, logo, user support email, and links sharing more information about the app.[2]
  • Host the app homepage and privacy policy on a verified domain you own.[2]
  • Disclose how your app accesses, uses, stores, and/or shares Google user data in your published privacy policy.[2]

Nuances that catch people out

  • Authorizations by a test user will expire seven days from the time of consent, including refresh tokens.[1]
  • Branding modifications are not permitted while verification is in progress.[2]

Evidence

What we could not verify

  • Exact maximum wait time for full OAuth scope verification.

Sources

Each quote was checked by code against the live page. “Not found on page” means the quote may be paraphrased, so treat that claim with care.

  1. Manage App Audience - Google Cloud Platform Console Help
    Provider docsQuote found on pagechecked 2026-10-19
    External Projects configured with a user type of External are available to any user with a Google Account.
  2. Manage OAuth App Branding - Google Cloud Platform Console Help
    Provider docsQuote found on pagechecked 2026-10-19
    Your brand must be verified if you want your application logo and application name to be visible to users on the consent screen.
  3. Usage limits  |  Gmail  |  Google for Developers
    Provider docsQuote found on pagechecked 2026-10-19
    All standard use of the Gmail API is available at no additional cost.