Every claim is tagged: tested, sourced, reported, inferred or unknown. See how

← All guides
Researched guide

Google (Gmail / Workspace APIs)

Testing with your own account is quick in 'Testing' mode with test users. Going to production with sensitive or restricted scopes (such as Gmail) means Google verification, which can take several weeks, plus an annual security assessment for restricted scopes accessed via a server.

Tier 4 · Gated / partner approval45-120 min hands-onResearched 2026-10-20
DifficultyTier 4 · Gated / partner approval

Sourced Restricted scopes require brand verification, a demo video, justification, and a Google-empanelled security assessment (CASA), repeated at least every 12 months. [e1]

Your time (hands-on)45-120 min

Inferred Test-mode setup only (our estimate). Production verification effort is much larger and not estimated.

Approval waitSeveral weeks

Sourced Google's restricted-scope page says verification can take several weeks. None of the other Google pages we read (verification help, FAQ) state a duration, so there is no official shorter figure to quote. [e1]

Composio managed authAvailable

Sourced Composio's Gmail toolkit page lists OAuth2 and says 'Composio-managed OAuth available.' So a developer can connect users without registering their own provider app first; register your own only for your own branding, scopes or rate limits. This is the toolkit page for Gmail; other Google toolkits were not each checked.

Open Composio's toolkit page

Who does what

An agent can

  • Draft the scope justification and a demo-video script from your design.
  • Check that your privacy policy and home page are public and on the same domain.

You must

  • Own the Google project and domains.
  • Record and upload the video.
  • Engage with Google and the security assessor.

Steps

  1. Create or pick a Google Cloud projectYouSourced

    Needed to configure OAuth clients and APIs. [e2]

    Why you: Needs your signed-in Google account.

  2. Enable the API and configure the consent screenYouSourced

    Enable the API (e.g. Gmail), open the OAuth consent screen, complete App Information, Audience (Internal or External), and Contact Information. [e2]

    Why you: Needs your signed-in Google account.

  3. Create the OAuth clientYouSourced

    Create OAuth client (Web application); add the redirect URI from your Composio auth config; copy client ID, then create a client secret. [e2]

    Why you: Secret goes to your secret store.

  4. Stay in Testing mode and add test usersYouSourced

    Add the Google accounts that will connect. Good for prototypes. [e2]

    Why you: Needs your Google account.

  5. Create the Composio auth config and connectYou or agentSourced

    Own credentials, paste client ID/secret, confirm redirect URI matches. [e2]

  6. For public production use: start verification earlyYouSourced

    Declare scopes, pass brand verification, submit video and justification, and if restricted scopes apply, arrange a CASA assessment. [e1]

    Why you: Legal, domain and security-assessment decisions and communication with Google are yours.

Requirements

  • Sourced Brand verification before data access review: a public home page related to the app, a privacy policy on the same domain linked from the consent screen, and verified ownership of authorized domains in Google Search Console. [e1]
  • Sourced Upload an unlisted YouTube demo video showing the English consent flow, app name, OAuth client ID in the address bar and each sensitive/restricted scope in use. [e1]
  • Sourced A written justification of how restricted scopes are used and why more limited scopes are not sufficient. [e1]
  • Sourced To start verification the app must already be published to production; apps in development, testing or staging are not applicable. [e6]
  • Sourced Verification needs a demo video showing the OAuth flow and how each scope is used, plus a written justification for sensitive or restricted scopes. [e7]

Scopes and access

  • Sourced Scopes are grouped as sensitive or restricted in the Cloud Console Data Access page; use least privilege. [e1]
  • Sourced Security assessment is required for restricted scope data accessed from or through a third-party server, performed by Google-empanelled assessors under the CASA framework. [e1]
  • Sourced Testing status: limited to up to 100 test users, who must be listed on the consent screen. [e3]
  • Sourced Testing status: a test user's authorization expires seven days after consent, so offline access breaks weekly until the app is in production. [e4]
  • Sourced Unverified apps requesting sensitive or restricted scopes hit a user cap: about 100 new users total over the project's life; Google says it cannot be reset. [e5]
  • Sourced Google caps refresh tokens at 100 per Google Account per OAuth client ID; creating more silently invalidates the oldest. [e8]

Review process

  • Sourced Verification: brand verification first, then data-access review of sensitive/restricted scopes; restricted scopes can require a security assessment by an empanelled assessor. [e1]

Gotchas

  • Sourced Composio's guide: keep the app in Testing while building and add test users; once In production it is available to all Google users and you may need to submit for verification. [e2]
  • Sourced Restricted-scope apps must be reverified and complete a security assessment at least every 12 months. [e1]
  • Sourced Brand verification results are valid for 7 days, then status changes to 'Need to re-verify'. [e1]
  • Sourced Google may email follow-up requests; keep developer and support contacts current and add extra project owners. [e1]
  • Sourced An insufficient justification can get the verification request rejected, which restarts your wait. [e9]

If you get stuck

Inferred 'App not verified' / access blocked for users outside the test list

Likely cause: App is in Testing mode, or In production without completed verification for sensitive/restricted scopes.

Fix: Add the user as a test user for prototyping, or complete verification for production.

Escalate when: Verification is rejected or needs more info and Trust & Safety emails arrive. [e1][e2]

Next actions

  • Prototype in Testing mode with test users.
  • If you will ship Gmail/Drive-like restricted scopes publicly, begin domain, privacy policy and video work early and budget for weeks plus a security assessment.

What was tested

Nothing here has been tested by hand yet.

What we are unsure about

  • No Google page we read gives a number of days or weeks for the OAuth review; 'several weeks' is the only stated figure and it comes from the restricted-scope page.
  • Cost of the third-party security assessment is not stated on the pages read.
  • Which scopes are sensitive vs restricted for a given API was not enumerated.
  • Brand verification timing was not found.
  • No hands-on test logged yet.

Sources

  1. [e1] Google - Restricted scope verification
    can potentially take several weeks to complete
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  2. [e2] Composio - Google Apps OAuth2 credentials
    Keep your app in testing while building.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  3. [e3] Google Cloud Help - Manage OAuth app audience
    Projects configured with a publishing status of Testing are limited to up to 100 test users
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  4. [e4] Google Cloud Help - Manage OAuth app audience
    Authorizations by a test user will expire seven days from the time of consent.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  5. [e5] Google Cloud Help - Manage OAuth app audience
    The user cap limits the number of users that can grant permission to your app
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  6. [e6] Google Cloud Help - OAuth app verification
    Apps in development, testing or staging are not applicable for verification
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  7. [e7] Google Cloud Help - OAuth app verification
    Provide a video that demonstrates the functionality, the OAuth flow of the app and shows how the scopes are being used.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  8. [e8] Google Identity - OAuth 2.0 overview
    There is currently a limit of 100 refresh tokens per Google Account per OAuth 2.0 client ID.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  9. [e9] Google Cloud Help - OAuth verification FAQ
    If your justification is deemed insufficient, your app verification request may be rejected.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  10. [e10] Composio docs - Gmail toolkit, Authentication Details
    Composio-managed OAuth available
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page

Ask this guide

Questions about the ten library providers are answered from the guides, with the passage each answer rests on. For any other app it researches the web live and says so.

About the builder

Built by Moulshree Bhutra

Founding APM at Vudio.ai, applying for APM, Toolkits at Composio (Bangalore). This prototype is my answer to the take-home: a way for a developer to see the cost of an OAuth app before starting, and to trust what they read.

How I approached the problem

  • Started from what already exists. Composio publishes 46 setup guides. I read ten in full: they cover the clicking, but not setup time, difficulty or the approval wait, which is where teams lose weeks.
  • Designed for one decision. A developer asks "should I start this today?" So effort, wait, and what only you can do come first, and the steps come after.
  • Made trust visible. Every claim is tagged tested, sourced, reported, inferred or unknown, and quotes link to the page they came from. Where no provider states a number, the guide says so instead of guessing.
  • Kept the agent honest in code. The live agent cannot mark anything tested, and a quote it cannot find in a page it actually read is removed. The method page lists what was and was not checked.

Why I am a good fit

  • I have owned a product through integrations and AI. At Vudio.ai I worked across three roles as it grew from a video-commerce tool into an AI marketing platform with 10+ modules, including Shopify-connected widgets and the product side of its Campaign agent.
  • Results I can point to. I contributed to about 7x ARR growth ($30K to $0.2M) over two years through 0 to 1 launches. I redesigned Shoppable Widgets and built self-serve onboarding: activation rose about 74% and turnaround fell from 13 days to 4. I led AI Studio from 0 to 1 (ARPU up 5% among fashion brands) and built an analytics dashboard that lifted free-to-paid conversion about 10%.
  • I build to understand. I have a computer science degree and I prototype my own ideas, so I can talk to engineers about trade-offs. Top 3 of 200+ in NextLeap's Product Management Fellowship.
  • I write down what I do not know. This project lists its own gaps, including that the hands-on registrations are still being run.

Find me

Prototype built for the Composio APM, Toolkits take-home. It never asks for credentials or secrets.