verapli
Sign inJoin free
Menu

Guides · productivity · Verification-gated

Google Workspace Marketplace listing (public or private app)

Publish a Workspace add-on, Chat app or web app to the Google Workspace Marketplace. Configure the Marketplace SDK and a store listing in your Cloud project; public apps must pass OAuth verification and a Marketplace app review, private apps are available to your own organisation straight away.

Researched · not yet run liveLast researched 25 October 2026 · Google · provider site

Researched, not yet run live. Built from the provider’s official pages (linked below). A person hasn’t walked this flow end to end yet, so check each step against the source.
Do this with verapliJSON for agents

Who owns what

The Marketplace listing is configured inside a Google Cloud project (Marketplace SDK). The same project holds the OAuth consent screen and client. Public listings can be published from any Google account's project; private (internal) listings must be built with a Google Workspace account and are visible only to that Workspace organisation.

  • Google Account or Google Workspace account organisation owned by the companyA Workspace account is required for private apps.
  • Google Cloud project with the Marketplace SDK enabled project owned by the company · under Google Account or Google Workspace account

Public versus private visibility cannot be changed after the app is published, so choose carefully.

The listing name must match the OAuth consent screen app name.

Have ready

  • google/cloud-project-run: Any Google Cloud project works; Cloud Run, Firestore and the domain parts are not needed.
  • google/oauth-verification: Public apps must have passed OAuth verification before the Marketplace review; restricted scopes also need the annual CASA assessment.
  • App icons 32x32 and 128x128 px (and 48x48 and 96x96 if the project includes a web app), plus a 220x140 card banner [3]Needed for: Create the store listing
  • 1 to 10 screenshots, 1280x800 recommended (640x400 or 2560x1600 accepted), square corners and full bleed [3]Needed for: Create the store listing
  • Privacy policy URL, terms of service URL and support URL, each a real web page [3]Needed for: Create the store listing
  • Website for the app or developer [1]Needed for: Create the store listing
  • A fully working, tested app (not still in testing) and a justification for each OAuth scope [2]Needed for: Submit for publication

Steps

Steps marked “human step” are ones only you can do: verapli never signs in, submits, pays or accepts terms for you.

  1. Use the app's Google Cloud project

    Create or reuse the Cloud project that holds the app's OAuth client and configuration.

    • Guided by hand
    • Human step: You press submit

    Where: https://console.cloud.google.com/projectcreate

  2. Configure OAuth and get it verified (public apps)

    Set up the OAuth consent screen with user type External and publishing status In production, request the narrowest scopes, and complete Google OAuth verification. Internal user type or Testing status is a common rejection cause.

    • Guided by hand
    • Human step: The provider reviews it
    • After: Use the app's Google Cloud project
    If something goes wrong (1)
    • Rejected for incorrect OAuth consent screen set-up or incomplete OAuth verification: Set user type to External, publish to production, finish OAuth verification, then resubmit. [2]

    Where: https://console.cloud.google.com/apis/credentials/consent

  3. Enable and configure the Marketplace SDK

    Enable the Google Workspace Marketplace SDK, then set visibility (public or private), installation settings (individual or admin install) and which Workspace apps the app extends.

    • Guided by hand
    • Human step: You press submit
    • After: Use the app's Google Cloud project

    Where: https://console.cloud.google.com/apis/library

  4. Create the store listing

    Fill in name, descriptions, category, icons, banner, screenshots and the terms, privacy and support links.

    • Guided by hand
    • Human step: You press submit
    • After: Enable and configure the Marketplace SDK
    If something goes wrong (2)
    • Rejected for Google trademarks in name, logo or description: Follow the Marketplace branding guidelines and remove Google marks from your own branding. [2]
    • Rejected for broken or misleading links or poor screenshots: Check every link loads and replace screenshots with full-bleed images that show the real app. [2]

  5. Submit for publication

    Press Submit for review yourself. Private apps become available to your organisation immediately; public apps go to Google review and publish automatically when approved.

    • Guided by hand
    • Human step: The provider reviews it
    • After: Configure OAuth and get it verified (public apps), Create the store listing
    The provider says
    App review typically takes several days, depending on queue and how much work the app needs. [2]
    If something goes wrong (2)
    • Review document says the app needs more work: Address each issue listed, then resubmit. [2]
    • App has bugs or is still in testing: Finish and test the app end to end before submitting. [2]

Terms and gotchas

Plain-English summary, not legal advice. Each card links its source.

Can get you bannedThe rules say

Suspension can reach related accounts

Serious or repeated policy violations can suspend your developer account and possibly related accounts; trying to get around enforcement leads to immediate termination. [4]

Can get you bannedThe rules say

No duplicate or spammy listings

Multiple apps with duplicate functionality (including from related accounts), keyword stuffing, or fake ratings and installs are prohibited. [4]

Can cost moneyThe rules say

Ask only for scopes you use now

Do not request scopes for future features; admin-installed apps must not prompt end users for consent afterwards. [4]

Can cost moneyThe rules say

Visibility is permanent

Once published you cannot switch an app between public and private. [1]

Renewals

  • Annual security reassessment (CASA) if the app uses restricted scopes: every 1 year [5]

Pricing

  • The official publishing pages mention no Marketplace listing fee [to verify]; restricted-scope security assessments may cost assessor fees (see google/oauth-verification).

Source [1]

For agents

The same entry as JSON: /api/v1/entries/google/workspace-marketplace · requirements /api/v1/requirements/google/workspace-marketplace · terms /api/v1/terms/google/workspace-marketplace.

Remote MCP (read-only, no auth)
claude mcp add --transport http verapli https://verapli.com/mcp

> "What do I need for Google Workspace Marketplace listing (public or private app), and how long will it take?"
  → tools/call requirements { "provider_id": "google/workspace-marketplace" }

Sources

  1. Google Workspace Marketplace – Publish an app (overview) Steps: Cloud project, OAuth (public apps may need OAuth review), test, enable Marketplace SDK, store listing (also for private apps), submit; public apps reviewed, private apps available immediately; private apps need a Workspace account; visibility cannot be changed after publishing; installation settings · accessed 25 October 2026 · official
  2. Google Workspace Marketplace – About app review Review covers name, developer info, description, functionality, UX, graphics and OAuth; app must have passed OAuth verification with narrowest scopes; review typically takes several days; common rejection reasons; review document then resubmit; approved apps publish automatically · accessed 25 October 2026 · official
  3. Google Workspace Marketplace – Create a store listing Name 50 chars and must match OAuth consent screen; short description 200 chars; icons 32x32 and 128x128 (plus 48x48 and 96x96 for web apps); banner 220x140; 1-10 screenshots, 1280x800 recommended, full bleed; terms of service, privacy policy and support URLs required · accessed 25 October 2026 · official
  4. Google Workspace Marketplace – Program policies Bans duplicate apps, keyword spam, fake ratings/installs, impersonation, hidden code, drip pricing; minimal OAuth scopes; privacy policy and limited use; serious or repeated violations suspend the developer account and possibly related accounts; circumvention means immediate termination · accessed 25 October 2026 · official
  5. Google Cloud Help – Restricted scope verification and security assessment Apps with restricted scopes need an annual CASA-based security assessment and are revalidated every year · accessed 25 October 2026 · official

Provider rules change. This page is generated from verapli registry version 2026.1025.316; spotted something out of date? Tell us. Google is not affiliated with verapli.