I want to connect to Gmail API with oauth refresh token, my project has the UserType External and now it is in testing status, so the refresh token is expired after 7 days. I think the scopes needed for reading emails are Restricted Scopes(https://mail.google.com/). I want this refresh token to be long lived, I should change the project status to production isn't it? My application has to permit the clients to configure their emails to connect to Gmail, is it necessary to pass a verification process with a youtube video to explain we want to connect to the email account for each of the Gmail accounts we want to use? Thank you
1 Answers
If you want your refresh tokens to last longer then seven days then you will need to set your project to production rather than test.
This is a separate matter from verification.
Once you are ready and done with development you will need to apply for verification of your app. Remember gmail scopes are one of the hardest scopes to have verified. Make sure that you fill out all of the fields related to your webpage and hosting of the privacy policy, create your YouTube video showing your app in works. You will most likely have to go though a security evaluation by a third party. This is not free and from what i know has to be completed every year. This is done for your application not for each user.
Thank you for your answer, so for what I understand you need like an administrator GCP account to manage all the gmail accounts you want in your application.
No you need to create a project on google cloud console, which will give you a client id and secret. This client id and secret can then be used to request authorization from users of your application. There is no limit to the number of users who can authorize your application.
Because what I thought is needed is to create a project and credentials in GCP for every gmail account you want to connect, so then you need a pass to production and verification for each one.
No you on only need one set of project credentials. Well two if you want to do it by the books, one for development and testing and another for your production application. Only the production application needs to be verified.
Related