I have a Google Cloud Project that is using some sensitive scopes and will soon get verified. Currently, there is one OAuth web app client ID, but in the near future, I am planning to add iOS and Android clients. I know that Google's documentation states that the app needs to be re-verified in case there are some additional sensitive scopes added, but I couldn't find what happens if I add new OAuth clients. The new clients will not use any of the sensitive scopes that the web app client uses. Will the app have to be re-verified after adding additional clients? Thank you.
1 Answers
As far as i understand you are verifying the consent screen. For example in the event you are using an api key no consent screen is needed, the same goes for service accounts.
Once you add any type of Oauth2 client you will need to apply for verification. Its the consent screen and the scopes that it is require that is verified.
Adding other clients should not effect your consent screen you have been verified for those scopes already.
Response from Oauth team member.
I have pinged someone on the OAuth team hoping to hear from them for verification.
update:
I am paraphrasing the response I got back from my google contact
Currently if you add a new OAuth client type you do not need to go though the reverification process. However google reserves the right to change that in the future.
Related