Restricted scopes cost money every year
Apps using restricted scopes need OAuth verification plus an annual CASA security assessment; Google quotes assessor fees of $500–$4,500. [1]
Guides · identity · Verification-gated
Google OAuth app verification (and CASA for restricted scopes)
Apps that request sensitive or restricted Google scopes need verification; restricted scopes also need an annual CASA security assessment.
Researched · not yet run liveLast researched 24 October 2026 · Google
Researched, not yet run live. Built from the provider’s official pages (linked below). A person hasn’t walked this flow end to end yet, so check each step against the source.
Have ready
- google/cloud-project-run: Any Google Cloud project works; the Cloud Run parts are not needed.
- Verified domain and homepage [to verify] Needed for: Submit for verification
- Privacy policy URL on that domain [to verify] Needed for: Submit for verification
- A clear justification for every scope you request [to verify] Needed for: Submit for verification
- Budget for the assessor if you use restricted scopes ($500–$4,500 quoted by Google) [1]Needed for: Complete a CASA assessment (restricted scopes only)
Steps
Steps marked “human step” are ones only you can do: verapli never signs in, submits, pays or accepts terms for you.
Create the OAuth consent screen
In your Google Cloud project, set up the OAuth consent screen (app name, support email, domains). [to verify exact flow]
Where: https://console.cloud.google.com/apis/credentials/consent
Request only the scopes you need
Dropping an unused restricted scope can move you onto the lighter verification-only track.
Submit for verification
You press submit. Google reviews the app.
Complete a CASA assessment (restricted scopes only)optional
Restricted scopes need a CASA security assessment with an authorised assessor.
- The provider says
- 2–3 weeks for tier 2; 4–6 weeks for tier 3 [1]
Terms and gotchas
Plain-English summary, not legal advice. Each card links its source.
Lapsed assessment brings back the warning
If the annual letter of validation lapses, the "unverified app" warning screen returns. [2]
What you end up with
| Env var | Secret | Format | What it is |
|---|---|---|---|
GOOGLE_CLIENT_ID | not secret | <number>-<random>.apps.googleusercontent.com | OAuth client id |
GOOGLE_CLIENT_SECRET | secret | GOCSPX-… | OAuth client secret |
For agents
The same entry as JSON: /api/v1/entries/google/oauth-verification · requirements /api/v1/requirements/google/oauth-verification · terms /api/v1/terms/google/oauth-verification.
Remote MCP (read-only, no auth)
claude mcp add --transport http verapli https://verapli.com/mcp
> "What do I need for Google OAuth app verification (and CASA for restricted scopes), and how long will it take?"
→ tools/call requirements { "provider_id": "google/oauth-verification" }Sources
- Google – App verification (OAuth verification and CASA) Restricted scopes need OAuth verification plus an annual CASA assessment; tier 2 takes 2–3 weeks, tier 3 4–6 weeks; assessor fees $500–$4,500 · accessed 24 October 2026 · official
- Nango – Google security review If the annual letter of validation lapses, the unverified-app warning returns · accessed 24 October 2026 · community
- Nylas – Fix Google access denied Dropping an unused restricted scope can move an app to the lighter verification-only track · accessed 24 October 2026 · community
Provider rules change. This page is generated from verapli registry version 2026.1025.387; spotted something out of date? Tell us. Google is not affiliated with verapli.