Short answer
If the app only needs sign-in (name, email, profile), request just those scopes and publish the app to In production: Google treats those scopes as non-sensitive, so they don’t need verification. If it needs Gmail, Drive or Calendar data, list the exact scopes on the consent screen and submit the app for verification. Restricted scopes, such as most Gmail access, also need a security assessment. Until then, users see the warning and the app is capped at 100 new users.
Why Google shows the warning, and a related gap
01
The app asks for sensitive or restricted scopes
“An unverified app is an app or Apps Script that requests a sensitive or restricted OAuth scope, but hasn't gone through the Google verification process.” Google, Unverified apps
Gmail, Drive, Calendar and similar access counts as sensitive or restricted. Until Google verifies the app for those scopes, users see the warning screen first.
02
The code asks for scopes the consent screen doesn’t list
“When the scopes requested in your app code differ from the scopes requested in your OAuth consent screen configuration page, your users see an "unverified app" screen.” Google, Unverified apps
AI-written code often adds scopes the app doesn’t need. Remove any you don’t use, and make sure every scope the code requests is listed on the consent screen configuration page.
03
The app is still in Testing
“Projects configured with a publishing status of Testing are limited to up to 100 test users listed in the OAuth consent screen.” Google, Manage App Audience
While the app is in Testing and asks for more than name, email and profile, only the test users you list can authorize it, and each authorization expires after seven days, which looks like a random logout. Publish the app when you launch.
04
The 100-user cap
“You need to go through verification before you launch a user-facing app.” Google, Unverified apps
Google caps an app at 100 new users in total once it has shown the unverified app screen. Start verification well before launch: you can keep building while Google reviews it.
05
Your app name and logo don’t show
“Without verification, only your application domain will be visible to users.” Google, Manage OAuth App Branding
Separate from the warning: without brand verification, the consent screen shows only your domain. Verify the brand on a domain you own to show your name and logo.
Checked against the vendor’s docs on : Google Cloud Help: Unverified apps; Google Cloud Help: Manage App Audience; Google Cloud Help: Manage OAuth App Branding.
Rather hand it over?
Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.
- from $450App Fix TicketOne reproducible bug in an existing mobile or web app, diagnosed and fixed.See scope and start
- from $450AI-Built App RescueA Lovable, Bolt or Cursor app checked end to end in 3 days, then its worst problems fixed at a fixed price.No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way.See scope and start
Related: Google sign-in redirect_uri_mismatch · Firebase Google sign-in popup blocked · Supabase OAuth provider disabled