{"registry_version":"2026.1025.387","generated_at":"2026-10-25T06:27:00Z","content_sha256":"089d16f627d9365e3d0663cc8069203706d7cb23a76c332226e29686968811a5","signed":true,"signature":{"key_id":"ed25519:74ca19268e364242","algorithm":"ed25519","expires_at":"2026-11-24T06:27:09Z","expired":false,"manifest":"/registry/manifest.json"},"entry_sha256":"1712e65aae6232616c09f7411b3a84424cd7a36dfa1ea3005803dbfb352f1587","entry":{"id":"google/oauth-verification","name":"Google OAuth app verification (and CASA for restricted scopes)","vendor":"Google","summary":"Apps that request sensitive or restricted Google scopes need verification; restricted scopes also need an annual CASA security assessment.","aliases":["google-oauth-verification","casa"],"category":"identity","group":"B","status":"researched","last_verified":null,"last_researched":"2026-10-24","sources":[{"id":"google-app-verification","url":"https://developers.google.com/health/app-verification","title":"Google – App verification (OAuth verification and CASA)","accessed":"2026-10-24","supports":"Restricted scopes need OAuth verification plus an annual CASA assessment; tier 2 takes 2–3 weeks, tier 3 4–6 weeks; assessor fees $500–$4,500","kind":"official"},{"id":"nango-security-review","url":"https://nango.dev/docs/api-integrations/google-shared/google-security-review","title":"Nango – Google security review","accessed":"2026-10-24","supports":"If the annual letter of validation lapses, the unverified-app warning returns","kind":"community"},{"id":"nylas-access-denied","url":"https://developer.nylas.com/docs/cookbook/use-cases/build/fix-google-access-denied/","title":"Nylas – Fix Google access denied","accessed":"2026-10-24","supports":"Dropping an unused restricted scope can move an app to the lighter verification-only track","kind":"community"}],"allowed_domains":["console.cloud.google.com"],"prerequisites":[{"entry":"google/cloud-project-run","note":"Any Google Cloud project works; the Cloud Run parts are not needed."}],"have_ready":[{"kind":"live_website","description":"Verified domain and homepage [to verify]","needed_for":["submit-verification"],"auto_check":"website_live"},{"kind":"app_privacy_policy_url","description":"Privacy policy URL on that domain [to verify]","needed_for":["submit-verification"],"auto_check":"website_live"},{"kind":"other","description":"A clear justification for every scope you request [to verify]","needed_for":["submit-verification"],"auto_check":"none"},{"kind":"payment_card","description":"Budget for the assessor if you use restricted scopes ($500–$4,500 quoted by Google)","needed_for":["casa"],"auto_check":"none","source":"google-app-verification"}],"steps":[{"id":"consent-screen","title":"Create the OAuth consent screen","summary":"In your Google Cloud project, set up the OAuth consent screen (app name, support email, domains). [to verify exact flow]","route":"guided","depends_on":[],"gate":"human_submit","url":"https://console.cloud.google.com/apis/credentials/consent"},{"id":"minimise-scopes","title":"Request only the scopes you need","summary":"Dropping an unused restricted scope can move you onto the lighter verification-only track.","route":"guided","depends_on":["consent-screen"],"gate":"none","sources":["nylas-access-denied"]},{"id":"submit-verification","title":"Submit for verification","summary":"You press submit. Google reviews the app.","route":"guided","depends_on":["minimise-scopes"],"gate":"third_party_review","preflight":["privacy_policy_reachable","website_live","display_name_matches_business"]},{"id":"casa","title":"Complete a CASA assessment (restricted scopes only)","summary":"Restricted scopes need a CASA security assessment with an authorised assessor.","route":"guided","depends_on":["submit-verification"],"gate":"third_party_review","lead_time":{"official":{"text":"2–3 weeks for tier 2; 4–6 weeks for tier 3","source":"google-app-verification"}},"optional":true}],"outputs":[{"name":"GOOGLE_CLIENT_ID","description":"OAuth client id","secret":false,"example_format":"<number>-<random>.apps.googleusercontent.com"},{"name":"GOOGLE_CLIENT_SECRET","description":"OAuth client secret","secret":true,"example_format":"GOCSPX-…"}],"terms_notes":[{"kind":"rules_say","severity":"amber","title":"Restricted scopes cost money every year","text":"Apps using restricted scopes need OAuth verification plus an annual CASA security assessment; Google quotes assessor fees of $500–$4,500.","source":"google-app-verification"},{"kind":"people_report","severity":"amber","title":"Lapsed assessment brings back the warning","text":"If the annual letter of validation lapses, the \"unverified app\" warning screen returns.","source":"nango-security-review"}],"renewals":[{"what":"CASA letter of validation (restricted scopes)","every":"1 year","every_days":365,"source":"google-app-verification"}],"pricing_notes":{"costs":"CASA assessor fees of $500–$4,500 (restricted scopes only)","source":"google-app-verification"}}}