An independent tool for SaaS teams shipping a Google Workspace integration - not affiliated with Google
Workspace VerifyWhich scopes will cost you weeks - and what do you send when the review comes back?
Paste the OAuth scopes your Google Workspace integration declares in code, the Marketplace SDK and the consent screen, and get the scope tiers, drift and verification gates checked, then the scope table with justifications and the dated plan, or the fixes for a rejected review. Your browser reads every scope from appsscript.json, a list of scope URLs or code, gives each its tier from the skill's ladder, finds the drift between the three places, flags a missed read-only variant, CASA, Limited Use, Testing status, the Cloud project's owner, granular consent and the Chat install setting, ranks whether you need a listing and dates the plan back from your launch.
The scopes, in all three places free
The interview - each answer moves a check or a rung free
The checks free
What the page flags
The scope table
Every check, rule by rule
Do you need a listing
The dated sequence
The three-place scope list free
The reconciled minimal list to paste identically into the code or manifest, the Marketplace SDK and the consent screen: the scopes the code declares, the read-only variant where a feature never writes, scopes with no feature note left out. A verification plan, once run, applies its drops and narrower scopes.
scopes.txt
The verification plan metered
Pricing as soon as the session is ready...
Sign inThe reply could not be read. Here it is as it came back:
Caveats
Caveats
The page's check of this reply
Saved integrations
How it works - and what is sourced
Every scope is read from what you paste: full scope URLs anywhere, and a short form such as gmail.send when it is a whole quoted string, a whole list line, or a scope the skill's ladder names - so method calls in code are never mistaken for scopes. Each scope gets a tier from the skill's scope ladder only: non-sensitive (drive.file with the Picker, the Gmail add-on open-message and compose scopes, gmail.labels, chat.bot, drive.install), sensitive (gmail.send, the add-on read-only and metadata scopes, most Calendar and Contacts scopes), restricted (mail.google.com, gmail.readonly, gmail.modify, gmail.compose, gmail.metadata, gmail.settings.basic, drive, drive.readonly, drive.metadata.readonly, drive.activity, chat.messages, chat.messages.readonly). Any other scope is unknown - read the API's scope page; the page never guesses.
The checks follow the skill's six rules, its interview, its routes and its sequence: identical scopes in three places, only scopes shipped features call, the read-only variant, restricted scopes and CASA, Apps Script add-ons with no outbound scope (practitioner reports, not Google policy), Limited Use and AI models, the consent screen's user type, Testing status, the unverified-app user cap, the Cloud project's owner, granular consent, the launch window, the demo video, the reviewer test account, the Chat install setting and listing visibility. The listing ladder ranks a verified OAuth client with no listing first for a web app; add-ons, Chat apps and Drive apps need a public listing. The sequence budgets one rejection round at the slow end of each figure, and the slower of verification and listing sets the date.
Every Google figure carries a dagger: verification up to 10 days† for sensitive scopes and over several weeks† for restricted ones, CASA renewed every 12 months†, 100 users† for an unverified app, branding within 7 days†, 2-4 weeks† end to end, AL1 or AL2†, labs quoting 2-6 weeks†, and the 6 weeks† re-rank window. † verify against current Google docs; Google renamed the security assessment's levels and moved verification timelines within a year.