Skip to content

Google verification and security assessment guide

Google APIs use the OAuth 2.0 protocol for user permissions and consent. If your application accesses Google user data with Google APIs, you might have to take additional steps to comply with Google’s OAuth 2.0 policies and complete the verification process before you publish your application.

In this guide, you’ll learn about the Sign in with Google branding guidelines and Google OAuth verification.

Sign in with Google branding guidelines

To complete the brand verification process, your application must have the “Sign in with Google” button that meets Google’s branding guidelines. This applies to the OAuth flow for both personal Gmail (@gmail.com) and Workspace email addresses.

For Hosted authentication, Nylas recommends you do one of the following:

  • Configure the OAuth login prompt by setting the prompt parameter with select_provider or detect,select_provider. For more information, see Configuring the OAuth login prompt.
    • If you add a login_hint that’s a personal Gmail or Workspace email address and you don’t configure a prompt during the Hosted auth flow, the user is immediately directed to the Google OAuth screen, without clicking the “Sign in with Google” button. This can result in delays or failure in verification.
  • Use the pre-approved “Sign in with Google” button with the “Connect your account” button or other provider login buttons in your application. For more information, see Google’s official Sign in with Google branding guidelines.

For Custom auth, use the pre-approved “Sign in with Google” button with the “Connect your account” button or other provider login buttons in your application.

Google OAuth verification

If your application accesses Google user data with the Google APIs and requests certain scopes, you might have to complete the Google verification process and a separate security assessment process. The processes that you need to complete depends on whether your application requests sensitive or restricted scopes.

Scope typeRequired processesGoogle policy and requirements
SensitiveGoogle verificationYour application must follow Google’s API Services User Data Policy.
RestrictedGoogle verification and security assessmentYour application must follow Google’s API Services User Data Policy and meet additional requirements for specific scopes.
  • If your app requests one or more sensitive scopes and doesn’t meet any of the criteria for an exception, you need to complete a Google verification process.
  • If your app requests one or more restricted scopes and doesn’t meet any of the criteria for an exception, you need to complete both Google verification and security assessment processes. For the security assessment process, Google will assign either Tier 2 or Tier 3 to your app and provide instructions and tools to complete the assessment.

For more information, see Google’s OAuth API verification FAQs.

Google scopes

The following are the Google scopes that Nylas projects use:

Scope typeScopeDescriptionVerificationSecurity assessment
Sensitivegmail.sendSend messages only. No read or modify privileges on mailbox.☑️
SensitivecalendarSee, edit, share, and permanently delete all calendars you can access using Google Calendar.☑️
Sensitivecalendar.readonlySee and download any calendar you can access using Google Calendar.☑️
Sensitivecalendar.eventsSee and edit events on all your calendars.☑️
Sensitivecalendar.events.readonlySee events on all your calendars.☑️
SensitivecontactsSee, edit, download, and permanently delete your contacts.☑️
Sensitivecontacts.readonlySee and download your contacts.☑️
Sensitivecontacts.other.readonlySee and download contacts that are saved in your “Other Contacts”.☑️
Sensitivedirectory.readonlySee and download your organization’s Google Workspace directory.☑️
Restrictedgmail.readonlyRead all resources and their metadata. No write operations.☑️☑️
Restrictedgmail.modifyAll read/write operations except immediate, permanent deletion of threads and messages, bypassing Trash.☑️☑️
Restrictedgmail.composeCreate, read, update, and delete drafts. Send messages and drafts.☑️☑️

Nylas projects also use the gmail.labels scope, which is neither sensitive or restricted and requires no Google verification or security assessment. The gmail.labels scope allows apps to create, read, update, and delete labels.

Exceptions to verification and security assessment

  • Apps that are not shared with anyone else or that access fewer than 100 Gmail accounts
  • Apps that are set to “Testing” and not “In production”
  • Apps that are configured to work only with internal Google accounts within your organization
  • Apps that have been allowed by Google Workspace admins

For more information, see Google’s OAuth API verification FAQs.

Google OAuth verification guide

The Google verification and security assessment processes can be daunting, but our Google OAuth verification guide can help you understand what needs to be done and provide step-by-step instructions on how to do it.