Google Verification
General guidance on Google's OAuth app verification process for anyone building against Google APIs -- what it is, why it exists, and what it requires.
What OAuth verification is
Any application that asks a Google user to grant access to their data through Google's OAuth consent screen goes through a review process before that consent screen can show as "verified" to real users. The review exists so a user granting access to their Gmail, Drive, or Calendar data has some assurance the requesting app is what it claims to be and requests no more access than it needs.
Sensitive and restricted scopes
Google classifies OAuth scopes by risk. Most scopes are unrestricted; some (broad read access to email, files, or contacts, for example) are classified sensitive or restricted, and trigger additional verification requirements beyond a basic review. Gmail's read-only scope is one of these restricted scopes.
Minimum scopes
Google's review checks that an app requests the narrowest set of scopes its stated functionality actually needs -- a broader scope than the product uses is a common cause of a verification request being sent back for clarification.
Privacy policy and app identity
A published, accessible privacy policy describing what user data is collected and how it is used, a verified domain the app actually runs on, and clear app branding (name, logo, support contact) consistent with what the consent screen shows, are all baseline requirements independent of which scopes are requested.
Demo video and in-app testing
For sensitive or restricted scopes, Google's reviewers typically ask for a short screen-recorded demonstration of the OAuth consent flow and of the requested scope actually being used inside the product, plus a way to sign in and test the flow themselves.
Use case and scope justification
A written explanation of why each requested scope is necessary for the app's stated purpose -- this is what Google's reviewers check the requested scopes against.
AI/ML use-of-data disclosure
Google's API Services User Data Policy includes Limited Use requirements that specifically address AI and machine learning: data obtained through a restricted Google API scope must not be used to train generalized AI or machine-learning models, and an app that processes such data with AI at all is expected to disclose that processing and confirm it does not violate this restriction.
CASA security assessment
For apps requesting sensitive or restricted scopes, Google (through the App Defense Alliance) requires an independent third-party security assessment -- the Cloud Application Security Assessment (CASA) -- appropriate to the assessment tier the requested scopes fall into, performed by an accredited lab, before verification can be completed or renewed.
How this applies to Selyf
Selyf requests Gmail's read-only scope, one of the restricted scopes described above, alongside the minimal openid and email scopes needed to identify an account -- see Authentication for the exact scopes and flow. Its data-handling practices, including the Limited Use commitments referenced above, are documented in full on Privacy & Data Usage.
This page describes Google's own general, publicly documented verification process, not any specific, in-progress verification case -- see Google's API Services User Data Policy for the authoritative source.