Requesting Minimum Scopes

Examples of Common Issues

Need further guidance on your requesting scopes? Navigate to the relevant finding for targeted remediation instructions.

The justification you provided in your Cloud Console submission does not sufficiently explain why the requested OAuth scopes are necessary

We require a thorough understanding of why you require access to certain scopes and what you intend to use that data for. Please reply directly to the email from the OAuth verification team to provide additional context for your application's use case. For a more efficient review, please list a rationale specific to the Google API you are requesting.

Example of an acceptable justification: My app will use https://googleapis.com/auth/calendar to show a user's Google calendar data on the scheduling screen of my app, so that users can manage their schedules through my app and sync the changes with their Google calendar.

I've been asked to use drive.file instead of restricted Drive API scopes

The Google Drive API User Data and Developer Policy requires that permission requests be limited to the critical information necessary to implement your application's services.

If your application’s user-facing features are limited to when a user uploads, downloads and/or deletes specific files, and/or creates folders, you should not request a broad-access restricted Drive scope.

For any exception request to the minimum scopes requirements, we would need evidence of functionality limitations to your application to consider additional data access.

Please follow the instructions provided here to create another project for testing and use the recommended drive.file and drive.appfolder scopes.

Replace any call in your code to https://googleapis.com/auth/drive with https://googleapis.com/auth/drive.file and https://googleapis.com/auth/drive.appfolder. It should work as expected without the need to use the Google Picker API.
You can also use the Google Picker API to display a file picker.
If your application is a Google Workspace add-on, you should use Advanced Drive Service in order to use the drive.file scope.
To allow users to open Drive files from a movile app, refer to Google Workspace APIs for Android or Google Workspace APIs for iOS.

Please note that the verification channel is not equipped to support you with any technical questions. If you have any questions in regards to your implementation, you can use the following resources to find community support:

For more information on the benefits of using drive.file with the Google Picker API, please refer to the Drive API documentation on choosing scopes.

Further documentation:

Migrating to narrower scopes

We recommend that you request access only to scopes that are required to enable your app’s functionality. During your app’s verification, we may recommend narrower scopes for your app. If this is the case, please reply directly to the email from the OAuth verification team with one of the following resolutions:

Respond “Confirm Downscoping” to confirm that you will migrate your app to use the recommended scopes.
Respond “Unable to use narrower scopes” and explain why.

How to migrate to recommended scopes without breaking your app

1. Create a separate project to test your app

If you need to test and evaluate the recommended scopes with your app, we recommend you use a separate cloud console project to do so. It is a recommended best practice to have separate cloud projects for development/testing and production/publishing.
If you add the recommended scopes to your production app’s codebase and start making API calls before these scopes are approved for your app, your users will start to see an unverified app warning pop-up.

To test your app with recommended scopes do the following:

Create a separate development/testing cloud project.
Configure the OAuth Consent screen and add only the recommended scopes
Configure a test deployment of your app to work with this test cloud project
Test your app’s functionality to confirm the recommended scopes are sufficient.

2. Update your production cloud project to include the recommended scopes

Once you are satisfied that the recommended narrower scopes are sufficient for your app’s functionality, add the recommended scopes to your cloud production project which is being verified:

Sign-in to the Google Cloud Console
Select the project-id
Go to Credentials on the OAuth Consent Screen configuration page
Go to Scopes for Google APIs
Click Add scope
Select the requested scope(s)
Click Add
Click Submit for verification

IMPORTANT!

DO NOT remove any approved scopes from your production cloud console project until your app verification is completed.

DO NOT make API calls to these new scopes from the production code until your app verification is completed.

Once your app is approved for the recommended scopes you can start to use these APIs scopes.

Make changes to your app code to use the recommended scopes.
Remove the broader scopes from the OAuth configuration of your production/publishing cloud project.

My application has been rejected for requesting scopes for future enhancements of my app that have not been implemented yet

We require that you only request scope access for implemented features. Please implement the feature for which you are requesting scope(s) and resubmit the application for verification for the additional scopes you are requesting access to.

The scopes listed on your OAuth consent screen are different from the scopes requested in your Cloud Console submission

In order to accurately verify your application’s request for Google APIs, we require that the scopes shown on the OAuth consent screen match those on your verification submission. Please ensure the presented scopes are accurate and up-to-date.

If your request falls under any of these scenarios, you should create a separate Cloud Console project to deploy in staging environment so that we can verify your application’s usage of the requested scopes:

Your application is live and you don’t want users to see the unverified app screen
Your application is already approved for sensitive/restricted scopes and you are requesting to add new sensitive/restricted scopes
Your application has already exhausted the 100 new user quota limit and sign-in to the API integration is disabled

Create a test project for verification by following these steps:

Create a new Cloud project.
Configure the OAuth Consent screen and add the required scopes
Configure the Publishing Status to “In Production”
Configure a test deployment of your app to work with this test Cloud project
Provide all information necessary for our team to access the test environment and use the app.

Once updated, re-submit your application with the correct scopes in your OAuth consent screen configuration.

Your application has been verified but you still need to remove overly broad restrictive scopes

IMPORTANT: Do not remove any scopes that are already approved in your project until you have received instructions from our team.

Once your verification is approved, please remove the old scopes. The following approach is recommended to avoid your users needing to re-authenticate multiple times. .

Revoke the existing user token for this scope, or remove access to the app entirely.
- For example, revoke the token with access to the overly broad scope.
- Consider revoking tokens while your users are using your app so that you can prompt for user consent immediately.
Prompt your users to give consent again.
- Users will get a new refresh token with only the new granular scopes, and without the overly broad scope.
- To prompt users to grant consent again, your app can use the same OAuth authentication request that was used when the user first signed up for your app, and add the URL parameter 'prompt=consent' as described in the Google OAuth documentation. Google OAuth will generate a new refresh token and send it back to your app with the authorization code exchange. You should use this new token going forward.
Remove the scope from your project's OAuth consent screen configuration page in Google Cloud Console
- Sign in to the Google Cloud Console
- Select the project ID
- Go to Credentials on the OAuth Consent Screen configuration page
- Go to Scopes for Google APIs and delete the overly broad scope
- Click Submit for verification

You can also revoke your users' tokens before they next use the app and authorize your current set of scopes, but this will make any offline API calls fail. You should only do this if you aren't worried about breaking the integration between revocation and sign-in. All tokens that contain unapproved restricted scopes will be revoked. As long as users consent to the approved scopes in a new authorization, then we will not revoke their tokens.

Different Google Drive scopes

Our reviewers have assessed your application and determined that the scopes you requested are too broad for its implemented features. We recommend the following “downscoping” based on the scopes you requested.

Full Scope Name	Scope Name	Description	Sensitivity	Recommended Downscope
https://googleapis.com/auth/drive	auth/drive	This app wants permission to access everything in your Google Drive. It will be able to do the same things you can do, including: See your files Upload and download your files Delete your files See the names and emails of people you share files with Share and stop sharing your files with others Remove people from your files Organize your Drive There may be private information in your Google Drive, like financial records, medical reports, photos or tax info.	Restricted	drive.file if your app needs view and manage Drive files and folders that are opened or created via the app drive.appdata or drive.appfolder If your app needs to create app-specific folders drive.readonly if your app needs to view the user’s files and/or folders within the app UI, but per-file selection with the drive.file scope via a file picker justifiably does not fit your use case. This downscope is only recommended if your app is unable to use any of the narrower scopes and needs read-only access.
https://googleapis.com/auth/drive.readonly	drive.readonly	This app wants permission to: See your Google Drive files Download your files See the names and emails of people you share files with There may be private information in your Google Drive, like financial records, medical reports, photos or tax info.	Restricted	drive.file
https://googleapis.com/auth/drive.activity	drive.activity	View and add to the activity record of files in your Google Drive. For example, view the history of changes to a Google Doc or add an activity event to a Google Sheet	Restricted	drive.activity.readonly
https://googleapis.com/auth/drive.activity.readonly	drive.activity.readonly	View the activity record of files in your Google Drive. For example, view the history of changes to a Google Doc	Restricted	None
https://googleapis.com/auth/drive.metadata	drive.metadata	View and manage metadata of files in your Drive, including the titles, descriptions, and last modified date of your files.	Restricted	drive.metadata.readonly
https://googleapis.com/auth/drive.metadata.readonly	drive.metadata.readonly	This app wants permission to see information about your Drive files, including: The titles and descriptions of your files The names and email addresses of people you share files with Your folders and how files are organized There may be private information in your Google Drive, like financial records, medical reports, photos or tax info.	Restricted	None
https://googleapis.com/auth/drive.scripts	drive.scripts	Modify your Google Apps Script scripts this app can access, allowing the script to take advantage of privileges in new ways (e.g., a script with access to your Gmail may be changed to send emails on your behalf)	Restricted	None
https://googleapis.com/auth/drive.meet.readonly	drive.meet.readonly	This app wants permission to access files in your Google Drive that Google Meet has created or edited. Once authorized, the app can: <li>See these files <li>Download these files <li>See the names and emails of people you share these files with There may be private information in your Google Drive, like financial records, medical reports, photos or tax info.	Restricted	If an app wants to revise/manage transcript data for a user or do any type of edit, sharing, modification of the artifacts, please recommend them the drive.file scope (if they can use "open with" flow).
https://googleapis.com/auth/drive.file	drive.file	View and manage Drive files and folders that you open or create with an app.	Non-sensitive	It is generally recommended to use the drive.file scope instead of a broader restricted Drive scope. Apps using a file picker may mistakenly request the Full Drive or drive.readonly scope when drive.file would be sufficient. Read the section below for more information.
https://googleapis.com/auth/drive.appdata https://googleapis.com/auth/drive.appfolder	drive.appdata drive.appfolder	View and manage the app's own configuration data in your Google Drive.	Non-sensitive	None
https://googleapis.com/auth/drive.install	drive.install	Allow apps to appear as an option in the "Open with" or the "New" menu.	Non-sensitive	None
https://googleapis.com/auth/drive.file https://googleapis.com/auth/drive.resource	drive.file drive.resource	View and manage Drive files and folders that you open or create with an app.	Non-sensitive	None
https://googleapis.com/auth/drive.apps.readonly	drive.apps.readonly	View apps authorized to access your Drive.	Sensitive	None

Why should you use drive.file?

drive.file is a non-sensitive scope that allows users to choose which files they want to share with your application. This gives them more control and confidence that your application's access to their files is limited and secure. In contrast, requiring broad access to all Drive files could discourage users from interacting with your application:

Usability: The drive.file scope works with all Drive API REST Resources which means you can use it the same way you use broader OAuth scopes
Functionality: The Google Picker API provides a similar look-and-feel to the Google Drive UI, several views showing previews and thumbnails of Drive files, and an inline, modal window, so users never leave the main application.
Convenience: Applications can narrow to certain Drive file types (e.g. docs, sheets, photos etc), via a filter on the Google Picker files

Since drive.file is non-sensitive, an additional security assessment will not be necessary. This will result in a more streamlined verification process for your application.

Different Gmail scopes

Full Scope Name	Scope Name	Description	Sensitivity	Recommended Downscope
https://googleapis.com/auth/gmail.addons.current.action.compose	gmail.addons.current.action.compose	Manage drafts and send emails when you interact with the add-on.	Non-sensitive	None
https://googleapis.com/auth/gmail.addons.current.message.action	gmail.addons.current.message.action	View your email messages when you interact with the add-on.	Non-sensitive	None
https://googleapis.com/auth/gmail.addons.current.message.metadata	gmail.addons.current.message.metadata	View your email message metadata when the add-on is running.	Sensitive	None
https://googleapis.com/auth/gmail.addons.current.message.readonly	gmail.addons.current.message.readonly	View your email messages when the add-on is running.	Sensitive	None
https://googleapis.com/auth/gmail.labels	gmail.labels	Create, read, update, and delete labels only.	Non-sensitive	None
https://googleapis.com/auth/gmail.send	gmail.send	Send messages only. No read or modify privileges on mailbox.	Sensitive	None
https://googleapis.com/auth/gmail.readonly	gmail.readonly	Read all resources and their metadata—no write operations.	Restricted	gmail.metadata for apps which are performing email monitoring and reporting, or for apps which check if emails have bounced
https://googleapis.com/auth/gmail.compose	gmail.compose	Create, read, update, and delete drafts. Send messages and drafts.	Restricted	gmail.send and gmail.labels if your application sends emails or invites users onto the platform via Gmail, and management of drafts in the source Gmail account is not needed. gmail.compose should be used if your app only needs to send emails and does not need to manage drafts.
https://googleapis.com/auth/gmail.insert	gmail.insert	Insert and import messages only.	Restricted	None
https://googleapis.com/auth/gmail.modify	gmail.modify	All read/write operations except immediate, permanent deletion of threads and messages, bypassing Trash.	Restricted	gmail.send (sensitive) and gmail.labels (non-sensitive) gmail.modify should be used if your app only needs to create labels and not mark email/threads.
https://googleapis.com/auth/gmail.metadata	gmail.metadata	Read resources metadata including labels, history records, and email message headers, but not the message body or attachments.	Restricted	None
https://googleapis.com/auth/gmail.settings.basic	gmail.settings.basic	Manage basic mail settings.	Restricted	None
https://googleapis.com/auth/gmail.settings.sharing	gmail.settings.sharing	Manage sensitive mail settings, including forwarding rules and aliases. Note: Operations guarded by this scope are restricted to administrative use only. They are only available to Google Workspace customers using a service account with domain-wide delegation.	Restricted	This scope is only available to Google Workspace customers using a service account with domain-wide delegation.
https://mail.google.com/	mail.google.com	Full access to the account's mailboxes, including permanent deletion of threads and messages This scope should only be requested if your application needs to immediately and permanently delete threads and messages, bypassing Trash; all other actions can be performed with less permissive scopes. Note: If the application is using SMTP or IMAP protocols, please refer to the section below titled “If your application uses SMTP or IMAP protocols.”	Restricted	gmail.send if the developer only needs to send emails or invite users on the platform via Gmail (Gmail.send is a sensitive scope. Projects requesting only sensitive scopes do not need to undergo a third-party security assessment. If the application only needs to compose and send messages, then gmail.send will be sufficient for everything the project needs to do.) gmail.readonly if the developer only needs to let users read emails using their app (show notifications, etc.) gmail.modify, gmail.readonly, or gmail.settings.basic to enable users to send emails from different aliases

If your application uses the IMAP or SMTP protocol:

Full mail (mail.google.com) is the only authorization scope for IMAP and SMTP. Please provide a justification for why your application requires this scope. Please note that the https://mail.google.com/ scope should only be requested if your application also needs to immediately and permanently delete threads and messages, bypassing Trash; all other actions can be performed with less permissive scopes. If your app does not permanently delete threads and/or messages, you will need to migrate to the Gmail API and request less permissive scopes.

If your application uses the SMTP protocol only:

In order to use the Gmail API and continue with the verification process, you need to migrate off SMTP protocol. Instead, you should use the https://googleapis.com/auth/gmail.send scope. This scope should still give your project enough access to work properly.

If your app uses SMTP protocol only, note that using the broad access https://mail.google.com/ scope just for sending emails with the SMTP protocol violates the minimum scope policy. To use the Gmail API and continue with the verification process, you will need to migrate off SMTP protocol and use the sensitive https://googleapis.com/auth/gmail.send scope instead.

If your application is a Gmail Add-On:

Generally, Gmail add-ons should not request broad access to user data with Restricted Scopes. Instead, we recommend that your app use Gmail Add-on Scopes which should be sufficient for your app and will not require you to go through a third-party security assessment. Please refer to the following table for more information on Add-On scopes.

Scope Name	Full Scope	Description	Category
current.message.compose	https://googleapis.com/auth/gmail.addons.current.action.compose	Manage drafts and send emails when you interact with the add-on.	Non-sensitive
current.message.action	https://googleapis.com/auth/gmail.addons.current.message.action	View your email messages when you interact with the add-on.	Non-sensitive
current.message.metadata	https://googleapis.com/auth/gmail.addons.current.message.metadata	View your email message metadata when the add-on is running.	Sensitive
current.message.readonly	https://googleapis.com/auth/gmail.addons.current.message.readonly	View your email messages when the add-on is running.	Sensitive

Why should you use gmail.send?

The Google API Services User Data Policy states that your application should request the minimum amount of data necessary for functionality. Additionally, gmail.send is a sensitive scope. Projects requesting only sensitive scopes do not need to undergo a third-party security assessment. If your application only needs to compose and send messages, then gmail.send will be sufficient for everything your project needs to do.

If you are unable to downscope, please reply to the email you received with a thorough justification for the Gmail Restricted Scopes you’re requesting and an explanation for why Gmail Add-on Scopes would be insufficient.

For example: The https://googleapis.com/auth/gmail.send scope (to send messages only) would not be sufficient because ____. And, https://googleapis.com/auth/gmail.compose can help me accomplish this because ____.

Different Fit scopes

Our reviewers have assessed your application and determined that the scopes you requested do not match the intended use case. We recommend you review the following scopes based on the functionality your app requires.

Scope	Description
fitness.sleep.read	Read sleep data from the Google Fit platform.
fitness.body.read	Read body measurement data (height, weight, body fat percentage) from the Google Fit platform.
fitness.heart_rate.read	Read heart rate data from the Google Fit platform.
fitness.blood_pressure.read	Read blood pressure data from the Google Fit platform.
fitness.blood_glucose.read	Read blood glucose data from the Google Fit platform.
fitness.reproductive_health.read	Read reproductive health data from the Google Fit platform.
fitness.body_temperature.read	Read body temperature data from the Google Fit platform.
fitness.oxygen_saturation.read	Read oxygen saturation data from the Google Fit platform.

Was this helpful?

How can we improve it?