Public apps that read users' Calendar events use sensitive scopes and need verification (unverified apps cap at 100 new users). [2]
Guides · productivity · Popular APIs
Google Calendar API (OAuth app)
Enable the Calendar API in a Google Cloud project, configure the OAuth consent screen, create an OAuth client, and complete sensitive-scope verification before a public launch that reads or writes users' calendars.
Researched · not yet run liveLast researched 25 October 2026 · Google · provider site
Researched, not yet run live. Built from the provider’s official pages (linked below). A person hasn’t walked this flow end to end yet, so check each step against the source.
Who owns what
A Google account owns a Google Cloud project; the OAuth client and consent screen live in that project.
- Google account personal owned by the person
- Google Cloud project project · under Google account
Have ready
- A Google Cloud project you own
- google/oauth-verification: Needed for External apps in production that request sensitive Calendar scopes (e.g. reading events).
- Public home page on a domain verified in Google Search Console [2]Needed for: Submit sensitive-scope verification
- Privacy policy on the same domain as the home page [2]Needed for: Submit sensitive-scope verification
- Unlisted YouTube video showing the consent flow (with client ID in the address bar) and how each scope is used [2]Needed for: Submit sensitive-scope verification
Steps
Steps marked “human step” are ones only you can do: verapli never signs in, submits, pays or accepts terms for you.
Enable the Google Calendar API
In your project's API Library, enable the Google Calendar API.
Where: https://console.cloud.google.com/apis/library/calendar-json.googleapis.com
Configure the consent screen
Under Google Auth platform > Branding enter app name and support email, choose Internal or External, add a contact email and accept the Google API Services User Data Policy.
Where: https://console.cloud.google.com/auth/branding
Choose the narrowest Calendar scopes
Under Data Access add only what you need (e.g. calendar.events.owned or calendar.freebusy rather than calendar). The console shows each scope's tier. Add test users under Audience while in Testing.
If something goes wrong (1)
- Test users have to reconnect every week: Testing-status refresh tokens expire after 7 days; publish to production when ready. [4]
Where: https://console.cloud.google.com/auth/scopes
Create an OAuth client ID
Under Google Auth platform > Clients create a client (e.g. Web application) with your redirect URIs and copy the ID and secret.
verapli captures
GOOGLE_OAUTH_CLIENT_SECREThere by plain code: encrypted in your browser, never shown to AI.Where: https://console.cloud.google.com/auth/clients
Submit sensitive-scope verificationoptional
For External production apps, publish branding, then submit data-access verification with per-scope justifications and the demo video. Internal and personal-use apps are exempt.
- The provider says
- Sensitive scope verification typically takes 3-5 business days. [2]
If something goes wrong (1)
- Users see "Google hasn't verified this app" and sign-ups stop at 100 users: Finish verification or drop to scopes that do not need it. [5]
Where: https://console.cloud.google.com/auth/verification
Terms and gotchas
Plain-English summary, not legal advice. Each card links its source.
What you end up with
| Env var | Secret | Format | What it is |
|---|---|---|---|
GOOGLE_OAUTH_CLIENT_ID | not secret | 123456789012-abc….apps.googleusercontent.com | OAuth 2.0 client ID |
GOOGLE_OAUTH_CLIENT_SECRET | secret | GOCSPX-… | OAuth 2.0 client secret |
Pricing
- Free tier: Standard use is at no additional cost within quota (10,000 requests/min per project, 600/min per user).
- Google says charges for exceeding quota are planned later in 2026 [to verify].
Source [6]
For agents
The same entry as JSON: /api/v1/entries/google/calendar-api · requirements /api/v1/requirements/google/calendar-api · terms /api/v1/terms/google/calendar-api.
Remote MCP (read-only, no auth)
claude mcp add --transport http verapli https://verapli.com/mcp
> "What do I need for Google Calendar API (OAuth app), and how long will it take?"
→ tools/call requirements { "provider_id": "google/calendar-api" }Sources
- Choose Google Calendar API scopes List of Calendar scopes (calendar, calendar.readonly, calendar.events, calendar.events.owned, calendar.freebusy, calendar.app.created, …); public apps using scopes that access certain user data must complete verification. · accessed 25 October 2026 · official
- Sensitive scope verification Reading Google Calendar events is cited as a sensitive-scope example; exceptions (personal use, Testing status, service-owned data, Internal); requirements (verified domain, home page and privacy policy on same domain, per-scope justification, unlisted YouTube demo video); typically 3-5 business days. · accessed 25 October 2026 · official
- Configure the OAuth consent screen and choose scopes Consent screen steps; Internal apps need no further review for sensitive/restricted scopes. · accessed 25 October 2026 · official
- Using OAuth 2.0 to Access Google APIs Testing-status refresh tokens expire after 7 days; 100 refresh tokens per account per client. · accessed 25 October 2026 · official
- Unverified apps Unverified app screen; unverified apps limited to 100 new users. · accessed 25 October 2026 · official
- Usage limits | Google Calendar Standard use at no additional cost; 10,000 requests/min per project, 600/min per user per project; overage charges planned later in 2026 with a 1,000,000 requests/day/project billing threshold. · accessed 25 October 2026 · official
Provider rules change. This page is generated from verapli registry version 2026.1025.387; spotted something out of date? Tell us. Google is not affiliated with verapli.