Domain for verification of a chrome extension

user_15690565 0
Viewed 211

I am in the process of implementing an OAuth2 flow for a sensitive scope in my chrome extension. In order to remove the 'unverified app' warning in the OAuth2 popup I must verify the app in the Google Cloud Console.

The verification form requires 'Authorized domains' though, and it does not accept a chrome extension URL of the form 'chrome-extension://', neither does it accept a URL of the form '.chromiumapp.org'.

Is it possible to provide another domain I own as the authorized domain, and still initiate an OAuth2 flow from the chrome extension using chrome.identity.getAuthToken({interactive: true}...?

google-oauth google-chrome oauth
1 Answers

I think you need to read though the documentation on application verification

The very first one mentions that your domain must be authorized and verified in search console. The files must also be hosted on your verified registered domain.

It clearly states that

Links to the Google Play Store or Facebook are not considered valid application homepages.

The only requirements are that

  1. Domain is registered in Search console.
  2. Home page listed in the auth screen is relevant to your app.

So i don't see any reason you can't put it on one of your other domains. Just make sure that it qualifies for this clear its relevance to the app you’re verifying

Relevant points in the documentation.

Verify ownership of your project’s authorized domains using the Search Console. Use an account that is either a Project Owner or a Project Editor of your Cloud Console project.

Then the section about

Make sure that your homepage meets the following requirements:

  • Your homepage must be publicly accessible, and not behind a sign-in page.
  • Your homepage must make clear its relevance to the app you’re verifying.
  • Your homepage must be accurate, inclusive, and easily accessible to all users.
  • Links to the Google Play Store or Facebook are not considered valid application homepages.

There is also the Privacy posily

Make sure that your app's Privacy Policy meets the following requirements:

  • The Privacy Policy must be visible to users, hosted within the domain of your website, and linked from the OAuth consent screen on the Google API Console.
  • The Privacy Policy must disclose the manner in which your application accesses, uses, stores, or shares Google user data. Your use of Google user data must be limited to the practices disclosed in your published Privacy Policy.

I have a video that goes though the application verification process. Google OAuth. What you need to know about verification in 2021.

user_18418390
Related