Gmail OAuth Verification Process
https://www.indiehackers.com/product/bybrand
A few weeks ago I started conversations to validate integration with Gmail, the amount they are charging me is really between $10,000 to $70,000
I can not afford it, and it is probably likely that I will suspend Bybrand integration with Gmail.
I use sensitive scopes:
https://www.googleapis.com/auth/gmail.settings.basic
(Manage sensitive mail settings, including forwarding rules and aliases. )
Has anyone at IH had the full experience, and did the approval of their APP?
I know the whole process is confidential, but it can write superficially.
Hi Bernado,
We've been through all of this at the beginning of the year. After 2 months and half of back and forth, several quotes way too expensive for our budget (at least $14K after negotiation), we've decided to pivot and completely remove all restricted scopes from Mailmeteor.
Mailmeteor is a Gmail add-on allowing you to send hundreds of personalized emails at once (https://mailmeteor.com). At first, we requested access to several restricted Gmail scopes. However, we have had to remove them. We did it by building the Gmail interface in Google sheets instead. That way, you can still compose and send emails.
In the end, it turned out to be a good thing for us. The workflow is much simpler for the user and Mailmeteor does NOT require access to Gmail data by design, contrary to other apps. Many customers are telling us that it was one of the main concern for them, that apps could read, modify or delete their emails, which Mailmeteor can't.
My 2 cents would be - if you can afford this - to try removing all use of restricted scopes and find other ways of achieving what you want (Or become rich enough to pay the security assessment each year...) If you need help in this process or support of any kind, we're glad to help.
Your case is excellent, thank you for sharing. My with Bybrand was between ~10K But it's only for Gmail 🙏, integration with G Suite does not need it because it's the administrator who has the control.
We update the email signature of the Gmail user, and we need the scope "auth/gmail.settings.basic", obligatorily, the alternative would be to create a browser extension. But this is out of our business model.
Thanks for this post as we were facing same for G Drive. We are still looking at a workaround as it does not seem worth it. Trying to limit hoops for users is paramount.
I am thinking of raising financing with the AppSumo or Crowdfunding. This idea came to me today.
This is a good place to start:
https://www.gmass.co/blog/live-updates-google-oauth-verification-security/
Hi @patwalls,
Thank you for share it.