1

I have my gmail extension running successfully with some good number of users. Now I've added some new functionality to that which require some additional restricted gmail permissions. As this is an extension, so if I deploy new changes to that without verification of new scope, users (new and old both) who will use new functionality of extension will see unverified consent screen.

So, I want to know if it's possible to submit dev or test app for oauth verification, while using production version keep intact. Also in case of extension I can't add deploy new features to extension which is in production, so how to provide new feature extension code to google for reviewing.

Ashish Rawat
  • 3,363
  • 5
  • 29
  • 35

1 Answers1

1

You have a few different options:

[1] Use incremental auth. If you have added new functionality, then there should be a separate path you can send users through that will request the new scopes. https://developers.google.com/identity/protocols/OAuth2WebServer#incrementalAuth You can then request app verification for the new scopes you register on the Google Cloud Developer Console.

[2] Flag protect your changes (make sure your changes are behind an experiment), where you control who will see the new behavior. You can then request app verification for the new scopes you register on the Google Cloud Developer Console.

[3] If you intend to switch between versions of your extensions, where each version is represented by a separate OAuth client ID or even a separate GCP project number, then you can certainly implement the new behavior using a new OAuth client ID and submit your app for verification for the project that your new client ID belongs to.

Note that for all options, any existing users who have already recorded grants for your old set of scopes should not be disrupted unless you request authorization for the new scopes.

user2705223
  • 1,219
  • 6
  • 10
  • Update for 2021 neither of those options will work as for restricted and sensitive scope you need to make a youtube video and you cant do that unless you actually add the scope to the project on Google cloud console which will now cause the client to pop back into testing phase. This will break your existing production application. – Linda Lawton - DaImTo Apr 26 '21 at 07:43
  • Adding a new scope can be done for a production application, do you have screenshots to show where your app switched to testing status upon adding new scopes? – user2705223 Apr 27 '21 at 12:39