{"registry_version":"2026.1025.387","generated_at":"2026-10-25T06:27:00Z","content_sha256":"089d16f627d9365e3d0663cc8069203706d7cb23a76c332226e29686968811a5","signed":true,"signature":{"key_id":"ed25519:74ca19268e364242","algorithm":"ed25519","expires_at":"2026-11-24T06:27:09Z","expired":false,"manifest":"/registry/manifest.json"},"id":"google/oauth-verification","name":"Google OAuth app verification (and CASA for restricted scopes)","vendor":"Google","status":"researched","last_verified":null,"last_researched":"2026-10-24","summary":"Apps that request sensitive or restricted Google scopes need verification; restricted scopes also need an annual CASA security assessment.","account_model":null,"prerequisites":[{"entry":"google/cloud-project-run","note":"Any Google Cloud project works; the Cloud Run parts are not needed."}],"identity_requires":[],"have_ready":[{"kind":"live_website","description":"Verified domain and homepage [to verify]","why":null,"needed_for":["submit-verification"],"auto_check":"website_live","source_url":null},{"kind":"app_privacy_policy_url","description":"Privacy policy URL on that domain [to verify]","why":null,"needed_for":["submit-verification"],"auto_check":"website_live","source_url":null},{"kind":"other","description":"A clear justification for every scope you request [to verify]","why":null,"needed_for":["submit-verification"],"auto_check":"none","source_url":null},{"kind":"payment_card","description":"Budget for the assessor if you use restricted scopes ($500–$4,500 quoted by Google)","why":null,"needed_for":["casa"],"auto_check":"none","source_url":"https://developers.google.com/health/app-verification"}],"steps":[{"id":"consent-screen","title":"Create the OAuth consent screen","summary":"In your Google Cloud project, set up the OAuth consent screen (app name, support email, domains). [to verify exact flow]","route":"guided","gate":"human_submit","human_only":true,"gate_label":"You press submit","depends_on":[],"optional":false,"url":"https://console.cloud.google.com/apis/credentials/consent","lead_time":null,"preflight":[],"captures":null},{"id":"minimise-scopes","title":"Request only the scopes you need","summary":"Dropping an unused restricted scope can move you onto the lighter verification-only track.","route":"guided","gate":"none","human_only":false,"gate_label":null,"depends_on":["consent-screen"],"optional":false,"url":null,"lead_time":null,"preflight":[],"captures":null},{"id":"submit-verification","title":"Submit for verification","summary":"You press submit. Google reviews the app.","route":"guided","gate":"third_party_review","human_only":true,"gate_label":"The provider reviews it","depends_on":["minimise-scopes"],"optional":false,"url":null,"lead_time":null,"preflight":["privacy_policy_reachable","website_live","display_name_matches_business"],"captures":null},{"id":"casa","title":"Complete a CASA assessment (restricted scopes only)","summary":"Restricted scopes need a CASA security assessment with an authorised assessor.","route":"guided","gate":"third_party_review","human_only":true,"gate_label":"The provider reviews it","depends_on":["submit-verification"],"optional":true,"url":null,"lead_time":{"official":{"text":"2–3 weeks for tier 2; 4–6 weeks for tier 3","source_url":"https://developers.google.com/health/app-verification","source_title":"Google – App verification (OAuth verification and CASA)"},"reported":null,"typical_minutes":null},"preflight":[],"captures":null}],"gates":[{"step":"consent-screen","gate":"human_submit","label":"You press submit"},{"step":"submit-verification","gate":"third_party_review","label":"The provider reviews it"},{"step":"casa","gate":"third_party_review","label":"The provider reviews it"}],"lead_times":[{"step":"casa","what":"Complete a CASA assessment (restricted scopes only)","official":{"text":"2–3 weeks for tier 2; 4–6 weeks for tier 3","source_url":"https://developers.google.com/health/app-verification","source_title":"Google – App verification (OAuth verification and CASA)"},"reported":null}],"outputs":[{"name":"GOOGLE_CLIENT_ID","description":"OAuth client id","secret":false,"example_format":"<number>-<random>.apps.googleusercontent.com","environments":null},{"name":"GOOGLE_CLIENT_SECRET","description":"OAuth client secret","secret":true,"example_format":"GOCSPX-…","environments":null}],"renewals":[{"what":"CASA letter of validation (restricted scopes)","every":"1 year","every_days":365,"source_url":"https://developers.google.com/health/app-verification"}],"estimated_minutes":null,"guide_url":"https://verapli.com/guides/google/oauth-verification"}