Google (Search Console, GA4, Business Profile)
Moderate. You can be reading your own Search Console and GA4 data within about 30 minutes in Testing mode. Clinic accounts need sensitive-scope verification first: free, about 1-3 weeks, with no CASA. Business Profile is a separate gate: its APIs return nothing (0 requests/minute quota) until Google approves a separate API access request. Request it first. The current catches are 7-day test tokens, gcloud's built-in client being blocked, and a 2026 classification bug for business.manage.
Review: Brand verification (minutes if automated, 2-3 business days if manual), then sensitive-scope verification (up to about 10 days) for webmasters.readonly and analytics.readonly. Business Profile also needs Google's separate API access approval. No security assessment.
Timing: 1-3 weeks for Search Console + GA4. Business Profile adds an access request that takes days to weeks; run it in parallel.
Before you start
- for buildYour own Google Cloud project and your own OAuth client. gcloud's built-in client is blocked for these scopes.testeds1
- for buildSearch Console API, Google Analytics Data API (plus the Admin API if you list properties), and the Business Profile APIs (My Business Account Management, Business Information, etc.) enabled on the projectinferreds9
- for buildApproved Business Profile API access (Application for Basic API Access form). Eligibility: a Business Profile verified and active for 60+ days, with a website.testeds7s1
- for launchA homepage and privacy policy on a Search Console-verified domain. The policy must describe the Google user data you use. Iskaria's /privacy has no such section yet (checked 2026-10-30).✓ Iskaria has ittesteds3s1
- for launchDomain ownership verified in Search Console by an account that is Owner or Editor on the Cloud project✓ Iskaria has itsourceds3
- for launchA demo video uploaded to YouTube as Unlisted. Iskaria has none yet.✗ missing in profilesourceds4
- for launchA support email that gets read. Iskaria has no shared support mailbox yet.✓ Iskaria has ittesteds1s3
Who does what
- Enable the APIs and fill the Branding fields from the profile
- Build the OAuth web flow, token storage and weekly test re-login
- Check the Business Profile quota (0 vs 300 QPM) to know when access is approved
- Draft the privacy-policy section and the demo-video script
- Diagnose Search Console 403s (permission level, sc-domain vs URL-prefix)
- Submit the Business Profile API access form as the profile manager
- Sign in to Cloud Console, add test users and click through the unsafe warning
- Approve and publish the privacy-policy change
- Record and upload the demo video
- Publish the app, submit for verification and answer reviewer emails
Steps
Submit Google's Business Profile API contact form and choose 'Application for Basic API Access'. Use the Cloud project number and an email that manages a verified profile. This is separate from OAuth verification. Until it is approved, the Business Profile APIs have a quota of 0 QPM. Approved projects show 300 QPM under IAM & Admin > Quotas.
https://developers.google.com/my-business/content/prereqsEnable the Google Search Console API, the Google Analytics Data API and the Admin API, and the Business Profile APIs. An agent with an authenticated gcloud can run `gcloud services enable searchconsole.googleapis.com analyticsdata.googleapis.com analyticsadmin.googleapis.com mybusinessaccountmanagement.googleapis.com mybusinessbusinessinformation.googleapis.com`.
https://console.cloud.google.com/apis/libraryIn Cloud Console, open Menu > Google Auth Platform > Branding, the old 'OAuth consent screen'. Enter the app name (matching the homepage), support email, logo, homepage, privacy policy, terms, authorized domains and developer contact.
https://console.cloud.google.com/auth/brandingApp name Iskaria User support email ibrahim@iskaria.com App logo missing: logo.square512PngMissing: no exported square PNG yet Application home page https://iskaria.com/ Application privacy policy link https://iskaria.com/privacy Application terms of service link https://iskaria.com/terms Authorized domains ["iskaria.com"] Developer contact information ibrahim@iskaria.com Under Audience, choose External and leave the publishing status as Testing. Add yourself and the pilot clinic accounts under Test users (100 at most).
https://console.cloud.google.com/auth/audienceAdd webmasters.readonly, analytics.readonly and business.manage (plus openid/email if you identify the user). Read the tier the console shows next to each scope. In 2026, several developers saw business.manage listed as non-sensitive while the consent screen still blocked external users.
https://console.cloud.google.com/auth/scopesUnder Clients, create a 'Web application' client for the console (redirect URIs below). A 'Desktop' client is fine for local scripts that use a loopback redirect. Do not rely on gcloud's built-in client (`gcloud auth application-default login`): Google shows 'This app is blocked' for these scopes.
https://console.cloud.google.com/auth/clientsAuthorized redirect URIs ["https://app.iskaria.com/api/oauth/{provider}/callback","http://localhost:3000/api/oauth/{provider}/callback"]Replace {provider} with e.g. google
Run the flow with access_type=offline. At the warning, click Advanced > Go to <app> (unsafe). Call the Search Console searchAnalytics.query and GA4 runReport. If you get 403 on a `sc-domain:` property, the account is only siteUnverifiedUser: have the owner grant it Full or Owner. Search Console only holds data from the day the property was added. Plan to log in again every 7 days while in Testing.
On iskaria.com/privacy, list the Google data read (Search Console performance, GA4 reports, Business Profile locations and reviews), why it is read, how it is stored, that it is not sold or used for ads, and how to revoke access. Add a statement that use of the data adheres to the Google API Services User Data Policy, including the Limited Use requirements.
https://developers.google.com/terms/api-services-user-data-policyPrivacy policy URL https://iskaria.com/privacyNo Google section yet (checked 2026-10-30) Record the English consent screen, the client ID visible in the address bar, and each scope in use: a Search Console chart, a GA4 report and a Business Profile view. Upload it to YouTube as Unlisted.
YouTube link missing: demoVideoUrlMissing Under Audience, click Publish app, then submit in Verification Center: brand verification first, then sensitive scopes. Justify each scope against a visible feature. Answer reviewer emails quickly.
https://console.cloud.google.com/auth/verification
Scopes an agent typically needs
| Scope | Used for | Review tier | Evidence |
|---|---|---|---|
| https://www.googleapis.com/auth/webmasters.readonly | Read Search Console performance (queries, pages, clicks) for the clinic's site | sensitive | testeds1s12 |
| https://www.googleapis.com/auth/analytics.readonly | Run GA4 reports (sessions, conversions, sources) for the clinic's property | sensitive | testeds1s9s12 |
| https://www.googleapis.com/auth/business.manage | Read the clinic's Business Profile locations, reviews and performance, and reply to reviews Classification is unclear. Unified.to calls it sensitive. A 2026 Google forum thread reports the console listing it as non-sensitive while external users are still blocked with 403 access_denied. Check your own Data Access page. | sensitive | inferreds8s10 |
| openid email | Identify which Google account connected | basic | sourceds2 |
What can slow you down or block approval
This is separate from OAuth verification. Until Google approves the 'Application for Basic API Access', the Business Profile API quota is 0 QPM and calls fail with 429. You must manage a profile that is verified and active for 60+ days and has a website.
Workaround: Submit the form on day one. Ship Search Console and GA4 first, and put Business Profile behind a flag.
Requesting Analytics or Search Console scopes through gcloud's own client shows 'This app is blocked'. You must create and use your own OAuth client.
Every connected account has to log in again weekly until the app is In production. Clinic staff will notice broken reports.
Workaround: Submit for verification as soon as the policy and video are ready
Several developers report that the console lists business.manage as non-sensitive, so Verification Center offers nothing to submit, yet external users get 'Access blocked... has not completed the Google verification process'. No Google resolution has been posted (thread still open in October 2026).
Workaround: Keep business.manage clients on the test-user list while you escalate through Google Cloud support. If you can, request business.manage alongside a sensitive scope so a verification submission exists.
A `sc-domain:` property returns 403 to an account that is only siteUnverifiedUser. Data exists only from the day the property was added, so a newly added clinic has no history.
Workaround: Have the clinic's owner grant Full user or Owner, and add the property as early as possible
What we checked
| Claim | How | Result |
|---|---|---|
| Business Profile APIs need a separate access request. Quota is 0 QPM until approved, 300 QPM after. | Fetched Google's Business Profile prerequisites page (s7), cross-checked with Unified.to (s8) and Iskaria's own experience (s1) | confirmed |
| business.manage is a sensitive scope Some 2026 consoles list it as non-sensitive while still blocking external users | Unified.to (s8) vs the Google developer forum thread, 2026-07 to 2026-10 (s10) | unverified |
| Testing-mode refresh tokens expire after 7 days | OAuth 2.0 overview (s2) plus Iskaria's weekly re-logins (s1) | confirmed |
| Common claim: sensitive-scope review takes 3-5 business days Google now says up to 10 days, after brand verification (minutes if automated, 2-3 business days if manual) | Google's sensitive-scope verification page (s4) | corrected |
| Consent screen is configured under 'APIs & Services > OAuth consent screen' It is now Google Auth Platform > Branding / Audience / Data Access / Clients | Workspace guide (s6) and Iskaria's console session (s1) | corrected |
| Business Profile API: quota 0 QPM until access approved; needs a profile verified and active 60+ days and a website Approved projects show 300 QPM. Google gives no turnaround time. | Independent check: fetched developers.google.com/my-business/content/prereqs on 2026-10-30 | confirmed |
| webmasters.readonly and analytics.readonly are sensitive scopes Neither public page labels sensitivity; only the Cloud console shows it. Still rests on the console warning Iskaria saw. | Independent check: fetched developers.google.com/identity/protocols/oauth2/scopes (full page) and Search Console authorizing guide on 2026-10-30 | unverified |
| Brand verification takes about 2-3 business days Automated check usually a few minutes; 2-3 business days only for manual review. reviewRequired updated. | Independent check: fetched Google's 'Brand verification' page on 2026-10-30 | corrected |
| OAuth endpoint behaviour (discovery metadata, PKCE, dynamic registration, unknown-client handling) Same Google authorization server as Gmail: PKCE plain and S256, no dynamic client registration; unknown client without scope -> 302 to signin/oauth/error (invalid_request). | Endpoint probe: node scripts/probe.ts on 2026-10-30 | confirmed |
- Google publishes no per-scope sensitivity list for webmasters.readonly and analytics.readonly. 'Sensitive' is inferred from the unverified-app warning Iskaria saw and from community docs.
- business.manage: sources conflict (sensitive per Unified.to; non-sensitive in some consoles in 2026, with external users still blocked). The fix path is unknown.
- Business Profile access approval time: Google gives no figure, only 'A follow-up email will be sent'. Community reports range from several days to a few weeks.
- Sensitive review duration: Google says up to 10 days, but follow-up rounds can stretch it. Our estimate is anecdotal beyond that.
Sources
- s1Iskaria's own setup, 2026-10-19 · our-test · accessed 2026-10-30
- s2Using OAuth 2.0 to Access Google APIs · official-docs · accessed 2026-10-30
“a publishing status of "Testing" is issued a refresh token expiring in 7 days”
- s3Restricted scope verification (brand verification and privacy policy requirements) · official-docs · accessed 2026-10-30
“Verify ownership of your project's authorized domains within the Google Search Console.”
- s4Sensitive scope verification · official-docs · accessed 2026-10-30
“The sensitive scope verification process can take up to 10 days to complete.”
- s5Manage App Audience (Google Cloud Help) · official-docs · accessed 2026-10-30
“limited to up to 100 test users listed in the OAuth consent screen”
- s6Configure the OAuth consent screen (Google Workspace) · official-docs · accessed 2026-10-30
“Google Auth platform”
- s7Business Profile APIs: Prerequisites · official-docs · accessed 2026-10-30
“If your quota is 0 QPM (Queries Per Minute), your project has not yet been approved.”
- s8Unified.to: How to set up Google Business Profile API access · community · accessed 2026-10-30
“which Google classifies as `Sensitive`”
- s9Dango: OAuth troubleshooting · community · accessed 2026-10-30
“is a Google-classified Sensitive scope”
- s10Google Developer forums: business.manage shown as non-sensitive but backend blocks external users · community · accessed 2026-10-30
“listed under “non-sensitive scopes””
- s11Google API Services User Data Policy · provider-policy · accessed 2026-10-30
“All other transfers, uses, or sales of user data are prohibited”
- s12Unverified apps (Google Cloud Help) · official-docs · accessed 2026-10-30
“The app or script might display an "unverified app" screen before it displays the consent screen.”
- s13Brand verification · official-docs · accessed 2026-10-30
“The automated brand verification process typically takes a few minutes ... [manual review] usually takes 2-3 business days.”
- s14Endpoint probe, 2026-10-30 · our-test · accessed 2026-10-30
“code_challenge_methods_supported: [plain, S256]; no registration_endpoint”