OAuth Readiness
Back to all apps

Google (Gmail)

Library guide, researched by Claude Code agents, checked 2026-10-19. Setup tested by hand on 2026-10-19.

You can create Google OAuth credentials yourself in minutes, but a public app that reads Gmail needs restricted scopes, so it has to pass brand verification, restricted-scope verification and a paid third-party security assessment (CASA) every year. Google's own estimate is about six weeks for restricted-scope review, and other Google pages say it can take several months. Until you are verified, you are limited to 100 test users or 100 users in total.

Tier 4: Review plus external requirements

Hands-on work
10–60 hours
Waiting for approval
14+ days
Confidence
high

Assumes: Public app (External user type, In production) that any Google user can connect, where an AI agent reads and sends the user's Gmail from your server. Typical scopes: gmail.readonly or gmail.modify (restricted), gmail.send (sensitive), plus openid/email/profile (non-sensitive). Because restricted Gmail data is stored on or passes through your servers, the annual CASA security assessment applies.

10 min1 hour1 workday1 week1 month6 months

Solid dark bar: your hands-on work. Amber: the minimum wait. Hatched: the range sources disagree on, or an open-ended wait.[7][5][9][10][2][22][28][11]

Biggest blocker: Gmail read access (gmail.readonly, gmail.modify) is a restricted scope, so a server-side agent needs restricted-scope verification plus a CASA security assessment that you pay a third-party assessor for and repeat every year. Google estimates about 6 weeks for this, and other Google pages say it can take several months.[1][9][2][22]

Recurring: Every 12 months, counted from the assessor's letter date, you must re-verify restricted scopes and pass a full CASA reassessment. The reassessment tests the whole app even if nothing changed, and you pay the assessor again.[3][14] Any change to branding (name, logo, home page, privacy policy, authorized domains) requires brand verification again. A passed result must be published within 7 days.[8]

Why tier 4? Set by: security assessment, mandatory fees.
The tier is computed from these seven facts by a fixed rule, not chosen by the AI. High: the gates that set this tier are backed by the provider's own docs or our own test.
Self-serve credentialsYesAny Google account can create a Cloud project, configure the Google Auth Platform (consent screen) and create an OAuth client ID/secret without contacting Google.[19][32]
Limits until reviewedYesWhen the publishing status is Testing, only users on the allowlist can sign in, up to 100 test users, and refresh tokens expire after 7 days. If you publish to In production before verification, users see the unverified-app screen and the project has a lifetime cap of 100 users that cannot be reset. Our test console showed: "Allowed user cap prior to app verification is 100, and is counted over the entire lifetime of the app."[15][17][4][16][13][32]
Provider reviewYesSensitive scopes such as gmail.send and restricted scopes such as gmail.readonly and gmail.modify require Google's verification before any Google account outside the test list can grant them without the warning and the cap. Brand verification has to be published first.[6][1][2]
Security assessmentYesIf an app stores or transmits restricted-scope Gmail data on servers, it must pass a CASA assessment by an assessor that Google has approved, and repeat it every 12 months. Gmail access that happens only on the client and never touches your servers is exempt, but that does not apply to a server-side agent.[1][2][3][20][21]
Business verificationNoGoogle does not require proof of a legal entity. What it does require is ownership of your authorized domains, verified in Google Search Console, plus a homepage and privacy policy on that domain. We found no step that checks business registration documents.[23]
Mandatory feesYesGoogle charges no fee. However, the CASA assessment required for restricted scopes is paid to an independent assessor at a price you agree with them. Reported prices: $540 to $1,800 per year for TAC Security's Tier 2 (secondary and community sources), roughly $500 to $4,500 depending on level and lab, and $15,000 to $75,000 in Google's 2019-era email to developers (out of date).[12][29][28][31][30]
Partner or paid accessNoThe Gmail API needs no partner program or paid API tier. Restricted Gmail scopes are, however, granted only for approved use cases such as email clients, backup, productivity enhancements (including generative AI summaries) and reporting.[25]

You can start today without any of this. Composio already provides a managed OAuth app for Google (Gmail) (gmail, googlesuper), so users can connect while you work through your own app. You need your own app for your brand on the consent screen, your own rate limits, or scopes beyond the defaults. Managed auth list

If your case is different

Sign-in only scopes
With only openid, email and profile, the app needs no sensitive or restricted verification. Brand verification (automated, sometimes 2-3 business days) is needed only to show your name and logo. In Testing status, these scopes are also exempt from the test-user allowlist and from the 7-day refresh-token expiry.
Sensitive scopes only (e.g. gmail.send, Calendar)
If the agent only sends mail (gmail.send) or uses sensitive scopes from other APIs such as Calendar, it needs brand verification plus sensitive-scope verification (3-5 business days per the developer docs, 10 business days per the FAQ), a demo video and a scope justification. No CASA assessment is required, so there is no annual cost.
Internal Google Workspace app
If every user is in your own Workspace or Cloud Identity organization and the project is owned by that organization with User type set to Internal, no verification is needed, and the unverified screen and 100-user cap do not apply. An organization admin may still need to approve the app. For customers on Workspace, their admin can mark your External app as Trusted, which removes the test-user cap and the 7-day token expiry for their users, but only for that organization.
Restricted data never touches your servers
If restricted Gmail data is accessed only on the client (for example in a browser extension or on-device) and is never stored on or transmitted through your servers, restricted-scope verification is still needed, but the CASA security assessment is not.

Steps

Agent steps an AI agent can do or draft for you. You steps that need your identity, accounts, legal authority or a real demo.

  1. Create a Google Cloud project and enable the Gmail API

    You

    Sign in with a Google account, accept the Cloud terms and create a separate production project. Google recommends keeping test and production projects separate.[19]

  2. Configure Google Auth Platform branding and audience

    Agent

    Enter the app name, support email, logo, home page, privacy policy and terms URLs, and authorized domains. Choose the External user type and add test users. An agent can fill these in once the account exists.[23]

  3. Create the OAuth client and redirect URIs

    Agent

    Create a Web application client and add redirect URIs and JavaScript origins on your authorized domains. Adding new redirect URIs after verification can trigger re-verification.[19]

  4. Pick the narrowest Gmail scopes and declare them

    Agent

    Add the scopes on the Data Access page. gmail.send is sensitive. gmail.readonly, gmail.modify, gmail.compose, gmail.metadata and https://mail.google.com/ are restricted. Request only the scopes your features use.[1]

  5. Verify domain ownership in Google Search Console

    You

    A project Owner or Editor must be a verified owner of each authorized domain in Search Console. This needs DNS or site access.[23]

  6. Publish a homepage and privacy policy that meet Google's rules

    You

    The homepage must be public, describe the app and link to the privacy policy. The privacy policy must be on the same domain and disclose how Google user data is accessed, used, stored and shared, including Limited Use. An agent can draft both, but you are legally responsible for them.[23]

  7. Run brand verification and publish branding

    You

    Click Verify Branding. The automated check usually takes a few minutes. Publish within 7 days of passing.[7][8]

  8. Wait for a manual brand review if the automated check is inconclusive

    YouWait

    Brand verification typically takes 2-3 business days when a manual review is needed.[10]

  9. Record and upload the demo video

    You

    Record an unlisted YouTube video showing the full OAuth grant flow in English, the client ID in the address bar, and each sensitive or restricted scope in use in the real app.[24]

  10. Write the scope justification and pick the permitted app type

    Agent

    Explain why narrower scopes are not enough and choose the Gmail use case under 'What features will you use?', for example productivity or generative AI summaries.[25]

  11. Submit data-access verification, then switch to In production

    You

    Submit from the Verification Center using the project owner's account, and answer Trust and Safety emails quickly. Each delay pauses the review.[9]

  12. Wait for sensitive and restricted scope review

    YouWait

    Google estimates 3-5 or 10 business days for sensitive scopes and 6 weeks for restricted scopes. These estimates are not guaranteed, and other Google pages say it can take several weeks to several months.[5][9][2][22]

  13. Hire a CASA assessor and pass the security assessment

    You

    Wait until Trust and Safety tells you to start, since this is the final step. Then choose an App Defense Alliance authorized assessor, pay them, run their scan and questionnaire, and fix any findings until you receive the Letter of Validation.[20][12][27]

  14. Wait for the assessor and Google's final approval

    YouWait

    TAC Security advertises 1-3 weeks for Tier 2 and 2-4 weeks for Tier 3 once it has everything it needs (secondary source). Finding vulnerabilities adds remediation time.[28]

What you will need

  • Two-step verification on your Google account. Google Cloud blocks console access without it (enforced since 22 June 2026, seen in our test).[32]
  • Authorized domains verified in Google Search Console by a project Owner or Editor[23]
  • A public homepage on the verified domain that describes the app and links to the privacy policy (not just a login page)[23]
  • A privacy policy on the same domain, linked from the consent screen, that discloses how Google user data is handled and follows Limited Use[23]
  • Unlisted YouTube demo video of the OAuth flow and each scope in use[24]
  • App logo, name, and support and developer contact emails[23]
  • A use case that fits Gmail's approved app types (email client, backup, productivity including AI summaries, reporting or monitoring)[25]
  • CASA Letter of Validation from an authorized assessor, renewed every 12 months[3][20]

Nuances that catch people out

  • In Testing status, refresh tokens expire after 7 days unless you request only openid, email and profile, so a long-running agent loses access every week during development.[17]
  • The 100-user cap for unverified apps applies over the project's entire lifetime and cannot be reset. If you launch on In production before verification, you can use up the cap for good.[13][16]
  • gmail.modify is restricted, not sensitive. Some vendor blogs say otherwise. Google's Gmail scope page lists gmail.modify, gmail.readonly, gmail.compose and gmail.metadata as restricted, and only gmail.send and some add-on scopes as sensitive.[1]
  • The free CASA self-scan is deprecated, so a paid assessor now does the work. Old guides that say you can self-scan for free are out of date.[27]
  • Each annual reassessment is a full test of the app, not a check of what changed. Google can also raise your assurance level (AL1 to AL2) as your user base grows.[14][21]
  • Each OAuth client can hold at most 100 refresh tokens per Google account. Creating more silently invalidates the oldest one.[18]
  • Even after verification, a Workspace admin can block or limit your app for their organization.[15]
  • Enable the Gmail API before adding scopes; until then gmail.readonly doesn't appear in the scope picker (you can also paste the full scope URL).[32]
  • Uploading a logo triggers brand verification for a published External app. Leave it off until you're ready to verify.[32]
  • The OAuth client secret is shown once at creation. Copy it into a secret manager immediately, or you'll have to reset it.[32]

If you get stuck or rejected

Users see the unverified-app screen even though you submitted for verification.
Make the scopes requested in code exactly match the scopes declared on the Data Access page. A mismatch triggers the warning.[22]
Brand verification fails or keeps asking you to re-verify.
Make sure every authorized domain is verified in Search Console by a project Owner or Editor, the homepage is public and links the same privacy policy as the consent screen, and you publish within 7 days of passing.[23][8]
Restricted-scope review is rejected because the use case is not allowed or a narrower scope would do.
Map each feature to an approved Gmail use case. Drop scopes the demo does not show (for example, use gmail.send for send-only). Explain in the justification why narrower scopes are not enough.[25][1]
The review stalls for weeks.
Watch the developer contact and support inboxes, and reply to Trust and Safety quickly. Google's time estimates depend on how quickly you respond.[9]

Evidence

What we tested by hand

With a personal Gmail account we created a Google Cloud project, set up the consent screen as External, added gmail.readonly and created a web OAuth client. Everything up to Testing mode was self-serve. We stopped where publishing required completing branding (home page, privacy policy, authorised domains), before any verification was submitted.

StepDocs saidWe sawMatch
Access Google CloudNot covered by our sources.Google Cloud blocked access until two-step verification was turned on ("Effective from 22 June 2026, Google Cloud has begun to enforce two-step verification"). We had to add a passkey. First run also asked for country and agreement to the Terms of Service.No
Add the Gmail scopeAdd gmail.readonly on the Data access page.The scope didn't appear until the Gmail API was enabled ("Only scopes for enabled APIs are listed"). Pasting the full scope URL into Manually add scopes worked.No
Scope classificationgmail.readonly is a restricted scope.It was listed under "Your restricted scopes: scopes that request access to highly sensitive user data."Yes
LogoBrand verification is needed to show your logo.The console warns that uploading a logo means you "will need to submit your app for verification" unless the app is Internal or in Testing.Yes
Create the OAuth clientSelf-serve.Created instantly with an http://localhost redirect URI. The client secret is shown only once: "You will no longer be able to view or download the client secret once you close this dialogue."Yes
Testing limitsTesting mode is capped at 100 users until verification."Allowed user cap prior to app verification is 100, and is counted over the entire lifetime of the app." Only listed test users can sign in.Yes
PublishPublishing with restricted scopes requires verification and a security assessment.Publishing wasn't available yet: "To publish your app, you must complete your configuration on the Branding page" (home page, privacy policy, terms, authorised domains). We stopped there and submitted nothing.Yes

What we could not verify

  • Hands-on hours (10-60) are an estimate based on the listed requirements (domain verification, policy pages, demo video, justification, CASA remediation). No source measures them.
  • Current CASA prices come only from secondary and community sources (mostly TAC Security's Tier 2 list price). Neither Google nor the App Defense Alliance publishes prices.
  • How the old CASA Tiers 2 and 3 map to the current AL1 and AL2 assurance levels, and which level a new Gmail app is usually assigned, is not stated on Google or ADA pages.
  • There is no official upper bound on total wait time. Google's estimates range from several weeks to several months, and none is guaranteed.

Sources

Each quote was checked by code against the live page. “Not found on page” means the quote may be paraphrased, so treat that claim with care.

  1. Choose Gmail API scopes
    Provider docsQuote found on pagechecked 2026-10-19
    https://www.googleapis.com/auth/gmail.send Send email on your behalf. Restricted scopes Scope code Description https://mail.google.com/ Read, compose, send, and permanently delete all your email from Gmail.
  2. Restricted scope verification
    Provider docsQuote found on pagechecked 2026-10-19
    In these cases, the system must undergo an annual security assessment from an independent, third-party assessor that is approved by Google. For this reason, the restricted scopes verification process can potentially take several weeks to complete.
  3. Restricted scope verification
    Provider docsQuote found on pagechecked 2026-10-19
    to keep access to any verified restricted scopes, apps must be reverified for compliance and complete a security assessment at least every 12 months after your assessor's Letter of Assessment (LOA) approval date.
  4. Restricted scope verification
    Provider docsQuote found on pagechecked 2026-10-19
    Note: Your app is still subject to a tester warning screen, as shown in figure 1, a user cap is in effect, and the refresh token lifetime is limited.
  5. Sensitive scope verification
    Provider docsQuote found on pagechecked 2026-10-19
    The sensitive scope verification process typically takes 3-5 business days to complete.
  6. Sensitive scope verification
    Provider docsQuote found on pagechecked 2026-10-19
    Sensitive scopes require review by Google before any Google Account can grant access.
  7. Submit for brand verification
    Provider docsQuote found on pagechecked 2026-10-19
    The automated brand verification process typically takes a few minutes after you click the Verify Branding button.
  8. Submit for brand verification
    Provider docsQuote found on pagechecked 2026-10-19
    Note: Compliant verification results are valid for 7 days.
  9. Frequently Asked Questions - OAuth App Verification
    Provider docsQuote found on pagechecked 2026-10-19
    deleting user data upon user request. 6 weeks * Please note that these estimates are not guaranteed and will vary based on developer responsiveness
  10. Frequently Asked Questions - OAuth App Verification
    Provider docsQuote found on pagechecked 2026-10-19
    verifying the logo, display name, URLs, domain ownership, etc. 2-3 Business days Sensitive Scope Verification
  11. Frequently Asked Questions - OAuth App Verification
    Provider docsQuote found on pagechecked 2026-10-19
    the Additional Requirements for Specific API Scopes . 10 Business days Restricted Scope Verification
  12. Frequently Asked Questions - OAuth App Verification
    Provider docsQuote found on pagechecked 2026-10-19
    Google does not charge the developer any fees for security assessment. Security assessments are conducted by CASA authorized independent security assessors.
  13. Frequently Asked Questions - OAuth App Verification
    Provider docsQuote found on pagechecked 2026-10-19
    Please note the user cap applies over the entire lifetime of the project, and it cannot be reset or changed.
  14. Frequently Asked Questions - OAuth App Verification
    Provider docsQuote found on pagechecked 2026-10-19
    We require the annual security reassessment to be a complete test of your application whether you have made any changes or not.
  15. OAuth app state overview
    Provider docsQuote found on pagechecked 2026-10-19
    Only users explicitly added to the test user allowlist can access the app (limited to a hard cap of 100 test users).
  16. OAuth app state overview
    Provider docsQuote found on pagechecked 2026-10-19
    for apps requesting sensitive or restricted scopes, unverified app warnings (Danger UI) will be displayed to users, and a hard cap of 100 total users applies.
  17. Using OAuth 2.0 to Access Google APIs
    Provider docsQuote found on pagechecked 2026-10-19
    A Google Cloud Platform project with an OAuth consent screen configured for an external user type and a publishing status of "Testing" is issued a refresh token expiring in 7 days
  18. Using OAuth 2.0 to Access Google APIs
    Provider docsQuote found on pagechecked 2026-10-19
    There is currently a limit of 100 refresh tokens per Google Account per OAuth 2.0 client ID. If the limit is reached, creating a new refresh token automatically invalidates the oldest refresh token without warning.
  19. Using OAuth 2.0 to Access Google APIs
    Provider docsQuote found on pagechecked 2026-10-19
    Visit the Google API Console to obtain OAuth 2.0 credentials such as a client ID and client secret that are known to both Google and your application.
  20. Security Assessment - Google Cloud Platform Console Help
    Provider docsQuote found on pagechecked 2026-10-19
    A security assessment is the final step of the restricted scopes review process.
  21. Security Assessment - Google Cloud Platform Console Help
    Provider docsQuote found on pagechecked 2026-10-19
    Applications are assigned to either the AL1 or AL2 assurance level.
  22. Unverified apps - Google Cloud Platform Console Help
    Provider docsQuote found on pagechecked 2026-10-19
    Depending on the sensitivity of the data being requested, verification might require several months for the app to complete.
  23. Verification requirements - Google Cloud Platform Console Help
    Provider docsQuote found on pagechecked 2026-10-19
    The homepage must be hosted on a verified domain you own
  24. Verification requirements - Google Cloud Platform Console Help
    Provider docsQuote found on pagechecked 2026-10-19
    Must show the end-to-end flow of your app including the OAuth grant process
  25. Google Workspace API user data and developer policy
    Provider docsQuote found on pagechecked 2026-10-19
    Applications that enhance the email experience for productivity purposes (such as applications for customer relationship management, delayed sending of email or mail merge, or providing generative AI summaries)
  26. When is verification not needed - Google Cloud Platform Console Help
    Provider docsQuote found on pagechecked 2026-10-19
    Note: Your app will not be subject to the unverified app screen or the 100-user cap if it's designated as internal-only.
  27. Scan Your App | App Defense Alliance
    Provider docsQuote found on pagechecked 2026-10-19
    The CASA self scanning process is deprecated
  28. Google CASA - Cloud Application Security Assessment 2026 (DeepStrike)
    Secondary sourceQuote found on pagechecked 2026-10-19
    one provider TAC Security advertises Tier 2 reassessment in 1- 3 weeks and Tier 3 in 2- 4 weeks once the lab has everything.
  29. The $50,000 Gmail Add-on Myth: What Google's CASA Certification Really Costs
    Secondary sourceQuote found on pagechecked 2026-10-19
    Through TAC Security, one of Google's approved assessment partners, Tier 2 pricing ranges from $540 to $1,800 per year.
  30. My feelings on Google's $15,000-$75,000 OAuth verification process and security assessment (GMass, 2019-2020)
    Secondary sourceQuote found on pagechecked 2026-10-19
    Depending on the scope and complexity of your app, the cost for the third-party assessment might vary from $15,000 to $75,000.
  31. Casa verification - Google Apps Script Community
    Community reportQuote found on pagechecked 2026-10-19
    $540 for Tier 2 (per year)
  32. Hands-on test: Google Auth Platform setup up to publishing (2026-10-19)
    Tested by uschecked 2026-10-19