Using the Nylas Shared Google App

Nylas Shared Google App is available as an add-on for Pro and Enterprise plans. Requires an annual Pro plan.

Google requires applications that access Gmail with restricted scopes to complete an OAuth verification and CASA security assessment before going to production. This process can take several weeks, and for many teams it becomes the single biggest delay in shipping a Nylas integration.

The Nylas Shared Google App removes that bottleneck. Nylas maintains a fully verified Google Cloud project that has already passed Google’s Tier 3 CASA assessment. When you enable it, your users authenticate through Nylas’ verified OAuth application instead of one you build and verify yourself.

Why use the Shared Google App

Avoid the CASA security assessment

If your application uses restricted Gmail scopes like gmail.modify or gmail.compose, Google requires a CASA (Cloud Application Security Assessment) before you can go to production. This is a Tier 2 or Tier 3 security audit conducted by a Google-authorized third-party assessor, and the process involves:

• Hiring an authorized assessor to audit your application’s security controls
• Remediating any findings before Google approves your application
• Repeating the assessment annually to maintain your verified status

The Nylas Shared Google App has already completed the most rigorous Tier 3 CASA assessment. Nylas handles every annual re-assessment going forward, so your team never has to engage a security assessor, prepare for an audit, or track renewal deadlines.

Build on the Nylas verified OAuth application

Even without restricted scopes, Google requires OAuth verification for any application using sensitive scopes (like calendar or contacts). This includes preparing a demo video, configuring branding requirements, and waiting for Google to review your submission. The verification process alone can take several weeks.

The Shared Google App is already fully verified for all Google scopes that Nylas supports. You build on that verification rather than running the process yourself.

Go to production faster

With the Shared Google App, you can go live with Google authentication the same day you enable it. There is no Google Cloud project to create, no APIs to enable, no OAuth consent screen to configure, and no verification to wait for.

Reduce ongoing maintenance

Owning a Google Cloud project means managing OAuth credentials, monitoring Google’s policy changes, and maintaining your verified status year over year. The Shared Google App offloads all of this to Nylas.

If you need whitelabeled OAuth (your company name on the consent screen instead of “Nylas”) or credential isolation for compliance, you should create your own Google auth app instead.

Before you begin

The Shared Google App is an add-on for the annual Pro and Enterprise plans. To add it to your plan, reach out to your Account Manager or contact the Nylas Sales team. Once it’s added to your plan, Nylas enables the feature for your organization.

After it is enabled, it can take a few minutes before the option appears in your Nylas Dashboard.

Enable the Shared Google App on a connector

If you already have users authenticated through your own Google Cloud project, enabling the Shared Google App means those users will need to re-authenticate. Make sure you have a re-authentication flow in your application before you enable this. See Migrate existing users to the Shared Google App for details.

Once the feature is enabled for your organization, you can turn it on when you create or edit a Google connector in the Nylas Dashboard.

1. Log in to the Nylas Dashboard.
2. Select the application where you want to use the Shared Google App. The application can be any environment type (Development, Staging, or Production).
3. Navigate to Connectors and either create a new Google connector or edit your existing one.
4. In the Google connector settings, you will see a toggle to use the Nylas Google OAuth Credentials. The toggle appears greyed out by default.
5. Click the toggle to enable it, then click Save.

The following video walks through the steps to enable the Shared Google App in the Nylas Dashboard:

The toggle may look greyed out even after the feature is enabled for your organization. This is the default “off” state. Click the toggle to switch it on, then save your connector settings.

After you save, Nylas configures the Google connector to use the Shared Google App credentials. Your users will see “Nylas” on the OAuth consent screen when they authenticate.

Select your Google scopes

When using the Shared Google App, you still choose which Google scopes your application requests. Select only the scopes your application actually needs.

Use parent scopes when possible. For example, selecting the calendar parent scope covers both read and write access, so you don’t need to also select calendar.readonly. Using parent scopes simplifies the consent screen and reduces the number of permissions your users have to review and approve.

For the full list of available scopes, see Google authentication scopes.

How it works

When you enable the Shared Google App, Nylas configures your Google connector to use credentials from a Nylas-owned, Nylas-verified Google Cloud project. Here’s what that means:

Component	Who owns it
Google Cloud project	Nylas
OAuth consent screen and branding	Nylas
OAuth client ID and client secret	Nylas
Google verification and CASA assessment	Nylas (already completed)
Token storage and refresh	Nylas
Scope selection	You (in the Nylas Dashboard)
API integration and data access	You (through the Nylas APIs)

Your users go through a standard OAuth flow. The only visible difference is that the consent screen shows “Nylas” as the application name rather than your own branding.

The Shared Google App can’t be used with a custom Hosted Authentication hostname. The OAuth client belongs to Nylas, so you can’t add your own callback URI to it, and the flow ends in redirect_uri_mismatch. Whitelabeling the auth flow requires your own Google Cloud project on the connector.

Migrate existing users to the Shared Google App

If you already have users authenticated through your own Google Cloud project and you switch to the Shared Google App, those users need to re-authenticate. Nylas cannot automatically migrate OAuth tokens between different Google Cloud projects because the tokens are tied to the specific OAuth client that issued them.

To migrate your users:

1. Enable the Shared Google App on your Google connector (see above).
2. Prompt your users to re-authenticate when they next access your application. This connects them to the Shared Google App.
3. After re-authentication, Nylas issues new grant IDs for the migrated users. Update your application to use the new grant IDs.

Your existing API calls remain the same once the new authentication is in place. The only change is the grant IDs associated with each user.

You don’t have to migrate all users at once. You can use multiple provider applications to run your own Google Cloud credentials alongside the Shared Google App. This lets you migrate users gradually while keeping both configurations active.

Switch to your own Google Cloud project later

You can switch from the Shared Google App to your own Google Cloud project at any time. Create your own Google auth app, then update your connector with your own credentials using the Connector Credentials API. Your existing grants continue to work, and users are migrated to the new credentials when they next re-authenticate.

What’s next

• Google authentication scopes - Review available scopes for your application
• Using multiple provider applications - Use your own Google Cloud credentials alongside the Shared Google App
• Google verification and security assessment guide - Understand what the Shared Google App replaces