Google APIs use the OAuth 2.0 protocol for user permissions and consent. If your application accesses Google user data with Google APIs, you might have to take additional steps to comply with Google’s OAuth 2.0 policies and complete the verification process before you publish your application.
In this guide, you’ll learn about the Sign in with Google branding guidelines and Google OAuth verification.
Sign in with Google branding guidelines
To complete the brand verification process, your application must have the “Sign in with Google” button that meets Google’s branding guidelines. This applies to the OAuth flow for both personal Gmail (@gmail.com) and Workspace email addresses.
For Hosted authentication, Nylas recommends you do one of the following:
- Configure the OAuth login prompt by setting the
promptparameter withselect_providerordetect,select_provider. For more information, see Configuring the OAuth login prompt.- If you add a
login_hintthat’s a personal Gmail or Workspace email address and you don’t configure apromptduring the Hosted auth flow, the user is immediately directed to the Google OAuth screen, without clicking the “Sign in with Google” button. This can result in delays or failure in verification.
- If you add a
- Use the pre-approved “Sign in with Google” button with the “Connect your account” button or other provider login buttons in your application. For more information, see Google’s official Sign in with Google branding guidelines.
For Custom auth, use the pre-approved “Sign in with Google” button with the “Connect your account” button or other provider login buttons in your application.
Google OAuth verification
The Google verification and security assessment processes can take several weeks or longer. Be sure to plan your development timeline around this.
If your application accesses Google user data with the Google APIs and requests certain scopes, you might have to complete the Google verification process and a separate security assessment process. The processes that you need to complete depends on whether your application requests sensitive or restricted scopes.
| Scope type | Required processes | Google policy and requirements |
|---|---|---|
| Sensitive | Google verification | Your application must follow Google’s API Services User Data Policy. |
| Restricted | Google verification and security assessment | Your application must follow Google’s API Services User Data Policy and meet additional requirements for specific scopes. |
- If your app requests one or more sensitive scopes and doesn’t meet any of the criteria for an exception, you need to complete a Google verification process.
- If your app requests one or more restricted scopes and doesn’t meet any of the criteria for an exception, you need to complete both Google verification and security assessment processes. For the security assessment process, Google will assign either Tier 2 or Tier 3 to your app and provide instructions and tools to complete the assessment.
For more information, see Google’s OAuth API verification FAQs.
Google scopes
The following are the Google scopes that Nylas projects use:
| Scope type | Scope | Description | Verification | Security assessment |
|---|---|---|---|---|
| Sensitive | gmail.send | Send messages only. No read or modify privileges on mailbox. | ☑️ | — |
| Sensitive | calendar | See, edit, share, and permanently delete all calendars you can access using Google Calendar. | ☑️ | — |
| Sensitive | calendar.readonly | See and download any calendar you can access using Google Calendar. | ☑️ | — |
| Sensitive | calendar.events | See and edit events on all your calendars. | ☑️ | — |
| Sensitive | calendar.events.readonly | See events on all your calendars. | ☑️ | — |
| Sensitive | contacts | See, edit, download, and permanently delete your contacts. | ☑️ | — |
| Sensitive | contacts.readonly | See and download your contacts. | ☑️ | — |
| Sensitive | contacts.other.readonly | See and download contacts that are saved in your “Other Contacts”. | ☑️ | — |
| Sensitive | directory.readonly | See and download your organization’s Google Workspace directory. | ☑️ | — |
| Restricted | gmail.readonly | Read all resources and their metadata. No write operations. | ☑️ | ☑️ |
| Restricted | gmail.modify | All read/write operations except immediate, permanent deletion of threads and messages, bypassing Trash. | ☑️ | ☑️ |
| Restricted | gmail.compose | Create, read, update, and delete drafts. Send messages and drafts. | ☑️ | ☑️ |
Nylas projects also use the gmail.labels scope, which is neither sensitive or restricted and requires no Google verification or security assessment. The gmail.labels scope allows apps to create, read, update, and delete labels.
Exceptions to verification and security assessment
- Apps that are not shared with anyone else or that access fewer than 100 Gmail accounts
- Apps that are set to “Testing” and not “In production”
- Apps that are configured to work only with internal Google accounts within your organization
- Apps that have been allowed by Google Workspace admins
For more information, see Google’s OAuth API verification FAQs.
Google OAuth verification guide
The Google verification and security assessment processes can be daunting, but our Google OAuth verification guide can help you understand what needs to be done and provide step-by-step instructions on how to do it.