When you publish your app, there are 4 main tasks to complete for authenticationand authorization:
- Fill out the OAuth consent screen.
- Create your OAuth 2.0 credential.
- Configure all scopes that the app needs to run in the Google Workspace Marketplace SDK
- Submit your app for OAuth verification.
The scopes you add to each place must match and are used in the following ways:
- The scopes added to the OAuth consent screen are used for OAuthverification.
- The scopes added to the Google Workspace Marketplace SDK are used for domain-wide and individual installs to authorize your app when its installed from the Google Workspace Marketplace.
- The scopes added to the manifest are necessary for your app to function properly.
For example, if you publish an app that includes a Google Sheetsadd-on and a Google Docsadd-on, each add-on'sApps Script manifest only includes the scopes specific to theadd-on. In your Google Cloud project, the OAuth consent screen and Google Workspace Marketplace SDKinclude the scopes for both add-ons.
Prerequisites
- In a Google Cloud project,enable billing.
- Build and test an app.
- .
- If you built your app in Google Apps Script, update your Google Cloud projectfor Apps Script projects.
1. Fill out the OAuth consent screen
The OAuth consent screen is a prompt that tells users who's requesting accessto their data and what kind of data users are allowing your app to access.
- In the Google Cloud console, go to Menu menu > APIs & Services > OAuth consent screen.
Go to OAuth consent screen
- Select the user type for your app, then click Create.
- Complete the app registration form, then click Save and Continue.
If you're creating an app for use outside of your Google Workspace organization, click Add or Remove Scopes. We recommend the following best practices when selecting scopes:
- Select the scopes that provide the minimum level of access required by your app. For a list of available scopes, see OAuth 2.0 Scopes for Google APIs.
- Review the scopes listed in each of the three sections: non-sensitive scopes, sensitive scopes, and restricted scopes. For any scopes listed in the "Your sensitive scopes" or "Your restricted scopes" sections, try to identify alternative non-sensitive scopes to avoid unnecessary additional reviews.
- Some scopes require additional reviews by Google. For apps used only internally by your Google Workspace organization, scopes aren't listed on the consent screen and use of restricted or sensitive scopes doesn't require further review by Google. For more information, see Scope categories.
- After selecting the scopes required by your app, click Save and Continue.
- If you selected External for user type, add test users:
- Under Test users, click Add users.
- Enter your email address and any other authorized test users, then click Save and Continue.
- Review your app registration summary. To make changes, click Edit. If the app registration looks OK, click Back to Dashboard.
2. Create your OAuth 2.0 credential
Depending on how you built your app, there are two different ways to createyour OAuth 2.0 credentials.
If you built your app in Apps Script
Switch your Apps Script project from its default Google Cloud projectto your new, standard project. SeeSwitching to a different standard project.
After you associate your Apps Script project with theGoogle Cloud project, your OAuth 2.0 credential is automatically created.
If you didn't use Apps Script to build your app
To create your OAuth 2.0 credential, seeOAuth client ID credentials.
3. Configure scopes
Provide a complete list of the OAuth scopes that your app requires. Always usethe narrowest scopes possible.
To define the level of access granted to your app, you need to identify anddeclare authorization scopes. An authorization scope is an OAuth 2.0 URI stringthat contains the Google Workspace app name, what kind of data it accesses, andthe level of access. Scopes are your app's requests to work with Google Workspace data, including users' Google Account data.
When your app is installed, a user is asked to validate the scopes usedby the app. Generally, you should choose the most narrowly focused scopepossible and avoid requesting scopes that your app doesn't require. Users morereadily grant access to limited, clearly described scopes.
4. Submit for OAuth verification (Public apps only)
If a public app uses sensitive or restricted scopes, it must undergo an OAuthverification review process.
- For OAuth verification, you must submit a demo video demonstrating thejourney or flow that explains the usage of the requested scopes or data tousers.
- If your app uses restricted scopes, it might also need to go through asecurity assessment. SeeWhy is the security assessment needed.
To submit for verification, follow these steps:
- In the Google Cloud console, go to Menu menu > APIs & Services > OAuth consent screen.
Go to OAuth consent screen
- Click Project selector, and select your project.
- Click Edit app
- Enter the required information, and then click Submit for verification.
- In the Verification required dialog, enter the appropriate justifications, and then click Submit to start the verification process.
If you update your app to use different scopes that are sensitive orrestrictive, you must submit your app for OAuth verification again. You don'tneed to send it for app review again.
How OAuth verification differs from app review
OAuth verification is a separate process from app review. It focuses on makingsure that your consent screen accurately represents your app's identity andintent, and makes sure your app doesn't misuse user data. Your app listingcannot be approved until your app's OAuth verification is complete. For moreinformation about OAuth verification, seeOAuth API verification FAQ.
App review focuses on the information that you provide in theGoogle Workspace Marketplace API,and the functionality and usability of your app. To learn more about the appreview criteria, seeAbout app review.
