OAuth Client Verification

  • Google requires verification for Google OAuth clients requesting certain sensitive OAuth scopes, though Apps Script projects within the same Google Workspace domain or customer are exempt.

  • Unverified Apps Script projects using sensitive scopes and accessed by users outside the domain will display an "unverified app" screen and have a cap on the number of unverified users.

  • Verifying your app with Google removes the unverified app screen and the user cap, building user confidence.

  • To request verification, you need a website on a verified domain hosting publicly-accessible information about your app and privacy policy, along with a standard Google Cloud project you have edit access for.

  • The verification process involves completing the OAuth consent screen in your app's Google Cloud project with details like application name, logo, support email, scopes, authorized domains, and homepage and privacy policy URLs.

Apps Script projects that request sensitive OAuth scopes.

Google OAuth clients that request certain sensitive OAuth scopes are subject to verification by Google. For a high-level overview of the authorization process, see Authorization for Google Services.

Verification isn't required for Google Apps Script projects whose owner and users belong to the same Google Workspace domain or customer.

If you don't verify your script project's OAuth client, users outside your domain see an unverified app screen when they try to authorize your script. An unverified authorization flow allows these users to authorize unverified apps and use them, but only after confirming they understand the risks. The total number of unverified app users is also capped.

For more information, see the following articles:

 

The unverified app warning screen.
Figure 1: Unverified app screen
An animated GIF showing the authorization flow for an unverified app.
Figure 2: Unverified app authorization flow

 

This change applies to Google OAuth web clients, including those used by all Apps Script projects. By verifying your app with Google, you can remove the unverified app screen from your authorization flow and give your users confidence that your app is non-malicious.

Unverified apps

Google Workspace add-ons, web apps, and other deployments (such as apps that use the Apps Script API) may need verification.

add-ons are no longer verified as part of the Google Workspace add-on review process, and must be verified prior to publishing an add-on.

Applicability