Google (Gmail API)
Setup takes about 30 minutes, and your own account can connect in Testing mode the same day. How hard launch is depends on the scope tier. With gmail.send alone (sensitive), you need brand and sensitive-scope verification: free, about 1-3 weeks. Reading, modifying or drafting mail in Gmail (gmail.readonly, gmail.modify, gmail.compose, gmail.metadata) uses restricted scopes. Those add a paid CASA security assessment by an authorized assessor, repeated every 12 months, so allow 4-10+ weeks. For Iskaria: keep drafts inside the app and request only gmail.send.
Review: Brand verification (minutes if automated, 2-3 business days if manual), then sensitive-scope verification (up to about 10 days). Restricted scopes also need restricted-scope review and an annual CASA security assessment with a Letter of Validation from an authorized assessor.
Timing: 1-3 weeks with gmail.send only (sensitive); 4-10+ weeks with any restricted Gmail scope (adds CASA).
Cost: Free for gmail.send only. Restricted scopes: a paid CASA assessment every year, roughly USD 540-1,800 per app per year at the AL1 level (TAC Security lists its Basic AL1 plan at USD 675), and more at AL2.
Before you start
- for buildA Google Cloud project with the Gmail API enabled, and a Google account that is Owner or Editor on itsourceds2
- for launchA public homepage on your own domain that describes the app and links to the privacy policy✓ Iskaria has itsourceds14
- for launchA privacy policy on the same domain that says how the app accesses, uses, stores and shares Google user data, with a Limited Use compliance statement. Iskaria's current policy has no such section (checked 2026-10-30).✓ Iskaria has ittesteds2s8s13
- for launchOwnership of every authorized domain verified in Google Search Console, by an account that is Owner or Editor on the project✓ Iskaria has itsourceds2
- for launchA demo video uploaded to YouTube as Unlisted. Iskaria has none yet (profile demoVideoUrl is null).✗ missing in profilesourceds3s11
- for launchA user support email and developer contact emails that get read. A shared mailbox is better than one person's inbox, because annual re-verification emails go there. Iskaria has no shared mailbox yet (sharedSupportMailbox is null).✓ Iskaria has itsourceds2
- for launchRestricted scopes only: budget and engineering time for a CASA assessment (scan, remediation, Letter of Validation), repeated every 12 monthssourceds2s6s7
Publishing status 'Testing': only the test users you list can sign in, up to 100. They see the 'Google hasn't verified this app' screen (Advanced > Go to <app> (unsafe)). Their authorizations, including refresh tokens, expire 7 days after consent. In production but unverified, the cap is 100 new users over the project's lifetime, and it cannot be reset.
Who does what
- Enable the Gmail API and draft every Branding field from the profile
- Choose the narrowest scope set and write the per-scope justifications
- Implement the OAuth web flow, token storage and the 7-day test re-login
- Draft the privacy-policy Google user data / Limited Use section
- Write the demo-video script and shot list
- Prepare for CASA: run a self scan and fix findings before the assessor's scan
- Sign in to Cloud Console and own the project (Owner/Editor)
- Click through the unverified-app warning as a test user
- Approve and publish the privacy-policy change
- Record and upload the demo video
- Publish the app, submit it for verification and answer reviewer emails
- Choose and pay a CASA assessor, every year, if any restricted scope is used
Steps
Create a Google Cloud project, or reuse one that is only for production. Google recommends separate projects for test and production. Enable 'Gmail API' under APIs & Services > Library. An agent with an authenticated gcloud can run `gcloud services enable gmail.googleapis.com`. A human has to sign in first.
https://console.cloud.google.com/apis/library/gmail.googleapis.comIn Cloud Console, open Menu > Google Auth Platform > Branding. This is the old 'OAuth consent screen'. If you see 'Google Auth platform not configured yet', click Get Started. Enter the app name exactly as it appears on your homepage, plus the support email, logo, homepage, privacy policy, terms, authorized domains and developer contact. Any branding change later sends the app back through brand verification.
https://console.cloud.google.com/auth/brandingApp name Iskaria User support email ibrahim@iskaria.comUse a shared mailbox if you have one. Iskaria has none yet. App logo missing: logo.square512PngMissing: export a square PNG of the Systems Mark. Adding a logo also requires brand verification. Application home page https://iskaria.com/ Application privacy policy link https://iskaria.com/privacy Application terms of service link https://iskaria.com/terms Authorized domains ["iskaria.com"] Developer contact information ibrahim@iskaria.com Under Audience, choose External, because clinic mailboxes sit outside your Workspace organization. Leave the publishing status as Testing. Under Test users, click Add users, add your own account and up to 99 more, then save.
https://console.cloud.google.com/auth/audienceUnder Data Access, click Add or remove scopes and add only what the feature needs. To send follow-ups composed in your own app, add gmail.send (sensitive). Each restricted scope you add (gmail.readonly, gmail.compose, gmail.modify, gmail.metadata) brings CASA with it. The console sorts each scope as non-sensitive, sensitive or restricted, so check the tier there before you commit to a design.
https://console.cloud.google.com/auth/scopesUnder Clients, click Create client and choose 'Web application' for the console's server flow. Add the authorized redirect URIs. Store the client secret server-side only. Use your own client: Google blocks gcloud's built-in client for some Google APIs ('This app is blocked').
https://console.cloud.google.com/auth/clientsAuthorized redirect URIs ["https://app.iskaria.com/api/oauth/{provider}/callback","http://localhost:3000/api/oauth/{provider}/callback"]Replace {provider} with the real path segment, e.g. gmail Authorized JavaScript origins app.iskaria.com
Run the authorization flow with access_type=offline so that you get a refresh token. The test user sees 'Google hasn't verified this app' and must click Advanced > Go to <app> (unsafe). Expect to repeat the login every 7 days while the app is in Testing, because the refresh token expires.
- 7Add a Google user data and Limited Use section to the privacy policyAgent drafts, you submit1-2 hsourceds8s15
On iskaria.com/privacy, state which Gmail data is accessed and why, how it is stored and shared, and how to revoke access or delete it. Add the Limited Use statement, e.g. '<App>'s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.' Also state that Workspace data is not used to train generalized AI/ML models. An agent can draft this. A human approves it and publishes it on the domain.
https://developers.google.com/terms/api-services-user-data-policyPrivacy policy URL https://iskaria.com/privacyIskaria's policy has no such section yet (checked 2026-10-30). Record in English. Show the full consent flow with the app name and the client ID in the browser address bar. Then show each Gmail scope being used inside the app, for example sending a follow-up. Narration helps the reviewer. Make sure the video is Unlisted, not Private: a private video stalls the review.
YouTube link missing: demoVideoUrlMissing in the Iskaria profile - 9Publish the app and submit it for verificationYou30 min hands-on, then 3-10+ days of waitingsourceds2s3s16
Under Audience, click Publish app. Then open Verification Center and submit. Brand verification runs first (usually a few minutes when the automated check passes, 2-3 business days if it goes to manual review), then the scope review. In the submission, justify each scope against a user-facing feature. Reviewers reply by email to the developer contact addresses, and work stops until you answer.
https://console.cloud.google.com/auth/verification - 10Restricted scopes only: pass the CASA security assessmentYou2-4 weeks calendar, several days of engineeringsourceds2s6s7s12
Once the restricted-scope review reaches the assessment stage, Google Trust & Safety tells you to start CASA. Pick an authorized assessor from the App Defense Alliance list (TAC Security is one) and pay. The assessor runs the scan and questionnaire. You fix the findings, and the assessor sends Google a Letter of Validation. Your app is placed at AL1 or AL2. Repeat this every 12 months.
https://appdefensealliance.dev/casa
Scopes an agent typically needs
| Scope | Used for | Review tier | Evidence |
|---|---|---|---|
| https://www.googleapis.com/auth/gmail.send | Send patient follow-up emails from the clinic's mailbox. Drafts are written and stored in Iskaria. This is the only Gmail scope that both sends mail and avoids CASA. Iskaria's use case needs nothing more. | sensitive | sourceds1 |
| https://www.googleapis.com/auth/gmail.compose | Create drafts in the clinic's Gmail so staff can review them there before sending Easy to mistake for a light scope, but it is restricted and triggers CASA | restricted | sourceds1 |
| https://www.googleapis.com/auth/gmail.readonly | Read patient replies so the assistant can answer or log them | restricted | sourceds1 |
| https://www.googleapis.com/auth/gmail.modify | Read, label and archive threads and send, all without permanent delete | restricted | sourceds1 |
| https://www.googleapis.com/auth/gmail.metadata | Headers and labels only (who wrote, when), without the message body Also restricted. There is no 'light read' Gmail scope. | restricted | sourceds1 |
| https://www.googleapis.com/auth/gmail.labels | Create and apply an 'Iskaria' label Non-sensitive | basic | sourceds1 |
What can slow you down or block approval
gmail.readonly, gmail.modify, gmail.compose and gmail.metadata are restricted. If restricted-scope data reaches or passes through your server, you need a CASA assessment from an authorized assessor, repeated at least every 12 months after the Letter of Assessment date. Miss the renewal and you lose access to the scopes.
Workaround: Design for gmail.send only: draft in Iskaria and send through Gmail. Add read scopes later, as their own verification round.
Brand and scope verification check that the policy explains how Google user data is accessed, used, stored and shared, and that it states Limited Use compliance. Iskaria's /privacy has none of this today.
Workaround: Add the section before you submit (see the step above)
Sensitive and restricted verification both need an Unlisted YouTube video of the consent flow and of each scope in use. A wrong visibility setting or missing English consent screen stalls the review.
In Testing, refresh tokens die after 7 days, so a pilot clinic has to re-consent every week. An unverified production app is limited to 100 new users over the project's lifetime.
Workaround: Keep pilots on a separate test project. Submit for verification early.
Changing the app name, logo, homepage or domain after approval sends you back through the brand check (minutes if automated, 2-3 business days if manual), and the app name must match the homepage.
The Workspace policy forbids using Workspace user data to create, train or improve AI/ML models beyond that user's own personalized model. An AI assistant that reads mail must not feed it into shared fine-tuning.
What we checked
| Claim | How | Result |
|---|---|---|
| gmail.send is sensitive. gmail.compose, gmail.readonly, gmail.modify and gmail.metadata are restricted. gmail.labels is non-sensitive. gmail.compose is often assumed to be a light scope. It is restricted. | Fetched the live Gmail API scopes page (s1) on 2026-10-30 | confirmed |
| The consent screen setup now lives in 'Google Auth Platform' (Branding / Audience / Data Access / Clients) Older guides still say 'APIs & Services > OAuth consent screen' | Workspace configure-consent guide (s10) plus Iskaria's own console session | confirmed |
| Common claim: sensitive-scope review takes 3-5 business days Google now says 'up to 10 days'. Brand verification alone is minutes if automated, 2-3 business days if manual (s16). | Google's sensitive-scope page (s3) | corrected |
| Common claim: CASA has a free Tier 2 self-scan and Tier 3 lab audits Google now assigns AL1 or AL2 assurance levels. Community sources (2026) say the free self-scan is gone. Google's page does not mention price. | Google Security Assessment help (s6), TAC price page (s7), 2026 community notes (s12) | corrected |
| Testing-mode refresh tokens expire after 7 days | OAuth 2.0 overview (s5) and Iskaria's own weekly re-logins (s13) | confirmed |
| Brand verification takes about 2-3 business days Google: automated check typically a few minutes; 2-3 business days only when it falls to manual review. Verdict, step and blocker updated. | Independent check: fetched Google's 'Brand verification' page on 2026-10-30 | corrected |
| gmail.send sensitive; gmail.compose, readonly, modify, metadata restricted; gmail.labels non-sensitive Also restricted: mail.google.com, gmail.insert, gmail.settings.basic, gmail.settings.sharing. | Independent check: re-fetched developers.google.com/workspace/gmail/api/auth/scopes on 2026-10-30 | confirmed |
| Testing: max 100 test users, authorizations incl. refresh tokens expire 7 days after consent; unverified production cap 100 users lifetime, not resettable | Independent check: fetched support.google.com/cloud/answer/15549945 on 2026-10-30 | confirmed |
| CASA is needed when restricted-scope data reaches or passes through your server, renewed every 12 months The help article says all restricted-scope apps are revalidated yearly without the server qualifier; the developer page keeps the 'from or through a third-party server' condition. CASA price not on any Google page (unverified). | Independent check: fetched support.google.com/cloud/answer/13465431 and the restricted-scope verification page on 2026-10-30 | confirmed |
| OAuth endpoint behaviour (discovery metadata, PKCE, dynamic registration, unknown-client handling) Discovery found at both oauth-authorization-server and openid-configuration; PKCE plain and S256; no dynamic client registration. Authorize with an unknown client redirected to Google's error page (invalid_request, missing scope) before checking the client. | Endpoint probe: node scripts/probe.ts on 2026-10-30 | confirmed |
- Real review durations: Google states a few minutes for automated brand checks (2-3 business days if manual), up to 10 days for sensitive and 'several weeks' for restricted. Community reports range from days to more than 2 months when there are follow-up rounds.
- CASA pricing and options: Google publishes no price. The figures come from TAC Security's page and blogs. Community posts (2026) say the free self-scan route for Tier 2 is gone and every option is paid. We could not confirm that on an official Google page.
- Whether a send-only server needs CASA: the restricted-scope rules apply to restricted scopes only, so gmail.send alone should not need it. We did not test a Gmail verification ourselves.
- Iskaria's own setup was tested with Search Console and Analytics scopes, not Gmail. The Gmail-specific steps are sourced, not tested.
Sources
- s1
- s2Restricted scope verification · official-docs · accessed 2026-10-30
“complete a security assessment at least every 12 months after your assessor's Letter of Assessment (LOA) approval date”
- s3Sensitive scope verification · official-docs · accessed 2026-10-30
“The sensitive scope verification process can take up to 10 days to complete.”
- s4Manage App Audience (Google Cloud Help) · official-docs · accessed 2026-10-30
“limited to up to 100 test users listed in the OAuth consent screen”
- s5Using OAuth 2.0 to Access Google APIs · official-docs · accessed 2026-10-30
“a publishing status of "Testing" is issued a refresh token expiring in 7 days”
- s6Security Assessment (Google Cloud Help) · official-docs · accessed 2026-10-30
“All applications must be revalidated every year.”
- s7TAC Security ESOF AppSec ADA CASA plans · community · accessed 2026-10-30
“Assessment to LoV in 2-3 Weeks”
- s8Google Workspace user data and developer policy · provider-policy · accessed 2026-10-30
“The use of information received from Google Workspace scopes will adhere to the Google User Data Policy”
- s9Unverified apps (Google Cloud Help) · official-docs · accessed 2026-10-30
“100 new users in total, after the app presents the unverified app screen”
- s10Configure the OAuth consent screen (Google Workspace) · official-docs · accessed 2026-10-30
“Google Auth platform”
- s11Demo Video (Google Cloud Help) · official-docs · accessed 2026-10-30
“The end-to-end flow of your app including the OAuth grant process.”
- s12freehire: Google OAuth verification notes · community · accessed 2026-10-30
“The free self-scan tier is gone.”
- s13Iskaria's own setup, 2026-10-19 · our-test · accessed 2026-10-30
- s14Verification requirements (Google Cloud Help) · official-docs · accessed 2026-10-30
“submitting to an annual security assessment from a Google empanelled group of security assessors”
- s15Google API Services User Data Policy · provider-policy · accessed 2026-10-30
“All other transfers, uses, or sales of user data are prohibited”
- s16Brand verification · official-docs · accessed 2026-10-30
“The automated brand verification process typically takes a few minutes ... [manual review] usually takes 2-3 business days.”
- s17Endpoint probe, 2026-10-30 · our-test · accessed 2026-10-30
“code_challenge_methods_supported: [plain, S256]; no registration_endpoint; unknown client_id + no scope -> 302 to signin/oauth/error (invalid_request: Missing required parameter: scope)”