Starting July 18, 2017, Google OAuth clients that request certain sensitive OAuth scopes will be subject to verification by Google.
Users from outside the developer’s domain accessing the OAuth prompt for a client that has not been verified will see a new unverified app screen, and the number of such users will be capped. An unverified authorization flow allows users to authorize unverified apps, but only after confirming they understand the risks. You can read more about this change in this help center article.
This change applies to Google OAuth web clients, including those used by all Apps Script projects. By verifying your app with Google, you can remove the unverified app screen from your authorization flow and give your users confidence that your app is non-malicious.
Add-ons, web apps, and other deployments (such as apps that use the Apps Script API) may need verification.
If the app uses sensitive OAuth scopes, the unverified app screen may appear as part of the authorization flow. Its presence (and the resulting unverified app authorization flow) depends on what account the app is published from and what account is attempting to use the app. For example, apps published in a specific G Suite organization do not result in the unverified app authorization flow for accounts in that domain, even if the app has not been verified.
The following table illustrates what situations result in the unverified app authorization flow:
|Client is verified||Publisher is a G Suite account of customer A||Script is in a Team Drive of customer A||Publisher is a Gmail account|
|User is a G Suite account of customer A||Normal auth flow||Normal auth flow||Normal auth flow||Unverified auth flow|
|User is a G Suite account not of customer A||Normal auth flow||Unverified auth flow||Unverified auth flow||Unverified auth flow|
|User is a Gmail account1||Normal auth flow||Unverified auth flow||Unverified auth flow||Unverified auth flow|
1Any Gmail account, including the account used to publish the app.
The number of users who can authorize an app via the unverified app flow is capped to limit possible abuse. See OAuth application user limits for details.
You can request a verification of the OAuth client used by your app and its Cloud project. Once your app is verified, your users will no longer see the unverified app screen. In addition, your app will no longer be subject to the user cap.
In addition, you must have the following required assets:
- Application name. The name of the app; this is displayed on the consent screen. It should match the name used for the app in other locations, such as the G Suite Marketplace listing for published apps.
- Application logo. A app logo JPEG, PNG, or BMP image to use in the consent screen. Its file size must be 1MB or less.
- Support email. This is an email displayed on the consent screen for users to contact if they need app support. It can be your email address or a Google Group that you own or manage.
- Scopes. The list of all the scopes your app uses. You can view your scopes in the Apps Script editor.
- Application homepage URL. The location of a homepage describing your app. This location must hosted on an authorized domain.
In addition to the above required assets, you can optionally provide an Application terms of service URL that points to a page describing your app's terms of service. If provided, this location must be in an authorized domain.
- In the Apps Script editor, select File > Project properties > Scopes. Copy all the scopes your script project uses.
- Ensure that you have access to the Cloud Platform project for your Apps Script Project. If your project resides in a Team Drive, you must associate it with a new Cloud Platform project.
- Access the API Console by selecting Resources > Cloud platform project… In the dialog that opens, click the top link, which is typically something like [Script Name] - project-id-123456789012. This opens your script's Cloud Platform project.
- If you can't find the left nav bar, click the icon in the top left.
- In the nav bar, select APIs & services > Credentials.
Update the OAuth consent screen form by providing the required assets.
To add your application scopes, click the Add scope button. The resulting dialog attempts to autodetect scopes for APIs you've enabled in the Cloud Platform (such as advanced services). You can select scopes from this list by checking the corresponding checkboxes.
This autodetected list doesn't always include scopes used by Apps Script built-in services. You must enter these scopes manually by clicking the manually paste link and then entering the scopes in the resulting checkbox.
When you are done selecting or entering scopes, click Add.
When you've entered all the required information, click Save.
Click Submit for verification to start a verification request.
Most verification requests receive a response within 24 to 72 hours. You can check the Verification status at the top of the OAuth consent screen form. When verification of your OAuth client is confirmed, your app is verified.