{"registry_version":"preview-2026-10-24","disclaimer":"Preview data. Not yet verified through the signed registry process; provider rules change. Plain-English summaries, not legal advice. Check the linked sources.","provider":"google-oauth-verification","display_name":"Google OAuth app verification (and CASA for restricted scopes)","category":"identity","status":"preview","last_verified":null,"summary":"Apps that request sensitive or restricted Google scopes need verification; restricted scopes also need an annual CASA security assessment.","steps":["Create a Google Cloud project and OAuth consent screen (human)","Request only the scopes you need: dropping an unused restricted scope can move you to the lighter track","Submit for verification (human presses submit)","Restricted scopes: complete a CASA assessment with an authorised assessor","Renew the CASA letter of validation every year"],"gates":[{"gate":"OAuth verification review","human_only":true},{"gate":"CASA security assessment (restricted scopes)","human_only":true}],"lead_times":[{"what":"CASA tier 2","official":"2–3 weeks (Google)","reported":"[to verify]"},{"what":"CASA tier 3","official":"4–6 weeks (Google)","reported":"[to verify]"},{"what":"OAuth verification without restricted scopes","official":"[to verify]","reported":"[to verify]"}],"have_ready":["Verified domain and homepage","Privacy policy URL on that domain","A clear justification for every scope","Budget for the assessor if you use restricted scopes ($500–$4,500 quoted by Google)"],"env_vars":["GOOGLE_CLIENT_ID","GOOGLE_CLIENT_SECRET"],"facts":[{"text":"Apps using restricted scopes need OAuth verification plus an annual CASA security assessment; Google quotes 2–3 weeks for tier 2, 4–6 weeks for tier 3, and assessor fees of $500–$4,500.","kind":"rules_say","source_url":"https://developers.google.com/health/app-verification"},{"text":"If the annual letter of validation lapses, the \"unverified app\" warning screen returns.","kind":"people_report","source_url":"https://nango.dev/docs/api-integrations/google-shared/google-security-review"},{"text":"Dropping an unused restricted scope can move an app onto the lighter verification-only track.","kind":"people_report","source_url":"https://developer.nylas.com/docs/cookbook/use-cases/build/fix-google-access-denied/"}]}