01 / THE OVERVIEW
Know the path before you start.
Scenario & assumptions
An AI agent accessing Google user data for external customers. Exact APIs and scopes must be selected before the approval path can be finalized.
- You are registering your own provider app; managed OAuth may offer another path.
- Hands-on estimates cover console configuration with an existing callback and account, not building the integration.
The launch path depends on audience and scopes. Creating a client is only one step; sensitive or restricted data can add verification work. [2][4][5]
Restricted-data access through a server can require a security assessment. Check the applicable exceptions; this path can take several weeks. [5]
Applies when: Restricted scopes and the data-handling architecture trigger the assessment requirements.
Reserve roughly 30–90 minutes for console configuration if the account, callback, and required materials are ready. This is a planning estimate, not a measured setup time or provider promise.
Planning estimateThe exact approval wait cannot be chosen until the scopes, audience, and applicable exceptions are known. Allow separate time to prepare missing product materials.
UnverifiedFor public use of sensitive scopes, check verification exceptions, then prepare domain/branding information, a privacy policy, scope justification and a demonstration. Google documents an estimate of up to 10 days for this review. [4]
Applies when: Public access to sensitive scopes when no verification exception applies.
Restricted-data access through a server can require a security assessment. Check the applicable exceptions; this path can take several weeks. [5]
Applies when: Restricted scopes and the data-handling architecture trigger the assessment requirements.
02 / YOUR SETUP PATH
From prerequisites to the next gate.
Before you begin
- 01
Prepare the project and web client
YouSelect a Cloud project, enable the API you need, and create a Web application OAuth client with your authorized redirect URI. [1]
- 02
Set audience and permissions
YouConfigure Branding, Audience, and Data Access. Select External for customers outside your organization and explicitly manage test users while testing. [2]
CHECKPOINTTesting, publishing, verification, and Workspace administrator policy are separate concerns. A test user's successful consent does not establish general customer access. [3]
- 03
Determine your verification path
YouFor public use of sensitive scopes, check verification exceptions, then prepare domain/branding information, a privacy policy, scope justification and a demonstration. Google documents an estimate of up to 10 days for this review. [4]
Applies when: Public access to sensitive scopes when no verification exception applies.
Restricted-data access through a server can require a security assessment. Check the applicable exceptions; this path can take several weeks. [5]
Applies when: Restricted scopes and the data-handling architecture trigger the assessment requirements.
CHECKPOINTThe exact approval wait cannot be chosen until the scopes, audience, and applicable exceptions are known. Allow separate time to prepare missing product materials.
Unverified - 04
Account for customer administrator policy
AdministratorGoogle verification does not override a customer's Workspace administrator. Their policy can still block the app. [3]
CHECKPOINTTesting, publishing, verification, and Workspace administrator policy are separate concerns. A test user's successful consent does not establish general customer access. [3]
03 / PERMISSIONS
Ask for the access you need.
04 / APPROVAL GATES
These are separate decisions.
Registration, review, distribution, and customer policy can each have their own requirements.
App registration
requiredSelect a Cloud project, enable the API you need, and create a Web application OAuth client with your authorized redirect URI. [1]
Scope / app review
conditionalFor public use of sensitive scopes, check verification exceptions, then prepare domain/branding information, a privacy policy, scope justification and a demonstration. Google documents an estimate of up to 10 days for this review. [4]
Applies when: Public access to sensitive scopes when no verification exception applies.
Restricted-data access through a server can require a security assessment. Check the applicable exceptions; this path can take several weeks. [5]
Applies when: Restricted scopes and the data-handling architecture trigger the assessment requirements.
User consent
requiredUsers authorize the requested access through Google's OAuth consent flow; creating a client does not grant access to their accounts. [1]
Organization policy
conditionalGoogle verification does not override a customer's Workspace administrator. Their policy can still block the app. [3]
Marketplace distribution
unresolvedThe reviewed material does not establish every approval condition for your exact scenario. Confirm unresolved gates before launch.
Unverified05 / WHEN YOU’RE BLOCKED
Find the next useful move.
The app works for a tester but an external customer cannot connect
Configure Branding, Audience, and Data Access. Select External for customers outside your organization and explicitly manage test users while testing. [2]
Testing, publishing, verification, and Workspace administrator policy are separate concerns. A test user's successful consent does not establish general customer access. [3]
Google verification does not override a customer's Workspace administrator. Their policy can still block the app. [3]
Review materials or scope justification are missing
For public use of sensitive scopes, check verification exceptions, then prepare domain/branding information, a privacy policy, scope justification and a demonstration. Google documents an estimate of up to 10 days for this review. [4]
Applies when: Public access to sensitive scopes when no verification exception applies.
06 / AGENT & HUMAN STEPS
Make the handoff explicit.
Research an agent can help with
An agent can find public documentation, organize the requirements, and flag missing evidence. This guide does not mean it has created or approved your app.
InterpretationWhere a person takes over
You control sign-in, account permissions, credentials, consent, domain ownership, and provider submissions. An administrator or provider may need to make the final decision.
Interpretation07 / OPEN QUESTIONS
Keep the unknowns visible.
- Which exact APIs and scopes are required?
- Do verification exceptions apply to your audience and processing architecture?
- What policy does each customer's Workspace administrator enforce?
08 / EVIDENCE & SOURCES
Inspect what supports the guide.
Provider documentation was reviewed. No signed-in registration, OAuth connection, or approval was completed.
Published review estimates can change; check the provider before setting a launch date.
Recorded observations
The request redirected to Google account sign-in; the research browser could not access that destination.
No signed-in console state, project, OAuth client or approval was inspected or created.
01Google: OAuth for web server applicationsdevelopers.google.com · Excerpt / documentation review
Any application that calls Google APIs needs to enable those APIs in the API Console.
Read the original source ↗02Google: configure consent and scopesdevelopers.google.com · Excerpt / documentation review
Generally, you should choose the most narrowly focused scope possible
Read the original source ↗03Google: app states and administrator controlsdevelopers.google.com · Excerpt / documentation review
Google Workspace administrators can always Block any OAuth app
Read the original source ↗04Google: sensitive scope verificationdevelopers.google.com · Excerpt / documentation review
The sensitive scope verification process can take up to 10 days to complete.
Read the original source ↗05Google: restricted scope verificationdevelopers.google.com · Excerpt / documentation review
If you store or transmit restricted scope data on servers, then you need to complete a security assessment.
Read the original source ↗Check the managed OAuth option
Composio may provide a managed app for the provider’s auth method. Your own app changes registration ownership, branding, scopes, or quotas; it does not remove provider conditions.
Composio managed OAuth directory ↗