Google (Gmail, Calendar, Drive)
HardA working dev OAuth client takes under an hour, but most Gmail-agent use cases (read, modify, draft) need restricted scopes, which require verification plus an annual third-party CASA security assessment.
Agent-researched, not yet reviewed by a personResearched 2026-10-20
Working in dev
30–90 min
Signing in with your own account
Any user can connect
6–10 weeks
Restricted Gmail scopes (read, modify, drafts), which most email agents need. Google estimates 6 weeks for restricted verification (not guaranteed); the CASA security assessment runs alongside and can add a few weeks. Reviews occasionally stall longer.
- Waiting on
- Google Trust & Safety review (brand, then data access), plus a CASA-authorized security lab's Letter of Validation for restricted scopes
- Cost
- Google charges no fees. Restricted scopes need an annual CASA assessment paid directly to an authorized lab, roughly US$500-$6,000+/yr per app depending on lab and tier (third-party pricing, unverified). You also need a domain and a hosted homepage and privacy policy.
What you need first
Google account, ideally a Google Workspace or Cloud Identity organization
Any Google account can create a Cloud project. An organization is required for the Internal user type and makes project ownership survive staff changes.
A domain you own, verified in Google Search Console by a project Owner/Editor
All authorized domains must be verified for brand verification. The homepage and privacy policy must live on this domain.
Public homepage (not just a login page) linking to a privacy policy on the same domain
Brand verification checks the homepage and privacy policy. The privacy policy URL must match the one configured on the Branding page.
Privacy policy that discloses Google user data access, use, storage and sharing, plus the Limited Use statement
Required by the API Services User Data Policy. Workspace scopes (Gmail/Drive/Calendar) require disclosing adherence to the Limited Use requirements.
Support email (a Google account or a Google Group you manage) and developer contact emails that are actually monitored
Shown on the consent screen. Trust & Safety sends review requests here, and missed emails stall or fail verification.
Separate Cloud projects for dev/staging and production
Google recommends separate projects. The unverified user cap is lifetime per project and cannot be reset.