PSA: New Google policy creates $15k barrier to entry for apps using the Gmail API
Starting this month, any apps that use the Gmail API must now undergo a security audit by a big name firm.
Google estimate that this will cost between $15k and $75k.
This is going to effectively cripple many small companies and indie developers who make improvement tools for Gmail.
More info here: https://cloud.google.com/blog/products/g-suite/elevating-user-trust-in-our-api-ecosystems
Thanks for posting this James. I believe it's an entirely drastic step for Google and seriously limits the number of devs that can use their API from now on.
This sucks for everyone who has spent time building on these APSs.
It is similar to what happened when Twitter made all of its API changes/restrictions.
When you build a product on the back of a free API, you are always going to be at their mercy.
I think the key here is to use APIs from companies who take their partner eco-system very serious. I worked a lot with Microsoft and SAP APIs, and we had regular meetings with product managers and even developers to discuss our needs. They look at their APIs not only as a service to vendors but also as a service to their customers.
Even from a marketing side Microsoft and SAP do a lot to bring vendors and customers together by organizing conferences and special customer roadshows. This is something which adds a lot of value on top of the technical aspects of simply integrating their APIs.
For my side project, I'm building my product around Google Calendar. It makes me sometimes a bit nervous because Google doesn't care that much about the vendor eco-system. Let's see how that goes :)
I have written an article taking through the approval process (so far) Some of the tips may be useful for others
http://blog.gsmart.in/applying-for-g-suite-api-approvals/
While it's easy to see Google as heavy-handed here, this is actually good policy.
The problem is that email security is a really, really big deal.
Get access to someone's Gmail account and you very quickly get access to bank accounts, trading accounts, personal health information, and passwords to every site that person uses.
What many people don't realize is that Gmail plugins can have access to everything you see on screen, and every email you receive and send. Google's right on this one.
For sure, I don't disagree that security is important.
However, I feel there must be a more even handed mechanism that we can find to accomplish this.
Looking through their docs, I don't see anything that actually mentions this (outside of the article you shared). Do you only have to undergo the audit once your app is a certain size, or is this the case for every dev?
Every app that uses restricted scopes has to submit for verification.
From what I've been able to work out with the verification team, any app that uses said scopes and that has data that pass through a server has to undergo an code and pentest audit.
So if you only request the Google API from the browser client (like KanbanMail, Darwin, Boxy etc), that's okay. But if you make the request from the backend (like my app LeaveMeAlone) then you must be audited.
So basically, after this, I'd expect to see newcomers into the "cold email" space to be desktop apps :)
A few notes from reading... this looks like it only affects consumer Gmail accounts, not enterprise so I wouldn't say it's completely crippling. It's also not unusual and if you want to develop a Salesforce app, in order to get approved you have to go through a similar process and pay for the security review. Given the nature of the data being accessed I'd like a high bar for integrating with it security wise. That said, I'm surprised by the cost estimates.
This was rumored, but didn't turn out to be true. Even if all your customers are Enterprise (like us) you'll get hit with the sensitive scopes API verification ransom from Google after Oct 28th 2019. We now have a "scary" unverified app splash screen.
I think so, but consumer apps are the ones most likely to be impacted by a high fee.
It depends if you're developing a product that's B2B or B2C. I don't assume "indie hackers" are targeting B2C over B2B. Either case is just as likely in my opinion. Lots of small companies and bootstrappers are targeting businesses.
This comment was deleted 8 years ago
Thanks so much for sharing this - one of my products relies heavily on the Gmail API, and despite being registered as a developer I didn't receive any heads up.
Perhaps you are not using restricted scopes? Though I think most Gmail apps will be. If you've been asked to resubmit for verification, then it's now part of that process.
@jivings I am currently in the same boat as well. My question to you since your app also uses Gmail API. How did you resolve it? Or you guys are still looking into that?
Does this apply to iOS calendar apps which allow users to add their google calendar?
Now applies to Calendar.
No, just the Gmail API.
15k to start....wow. This has to be for security reasons, right? Do you think this will apply to other Google APIs like Maps, Calendar, etc?
Now applies to Calendar.
Just Gmail APIs right now.
What’s preventing you from moving the logic to the client?
Performance mostly.
I'm pretty sure we could do it, but it would be a huge hit to performance. Yesterday we streamed over 50k emails for a single user.
Apologies for a somewhat off-topic question, but what kind of use-cases generate such amounts of email? Are these some automated emails, or are they by-humans and for-humans? Or is this something like a newsletter, with one sender and multiple recipients? Thanks.
I created an app that shows you a list of subscription emails that you can then choose to unsubscribe from automatically (https://leavemealone.xyz).
We basically scan the metadata of the last 1-6 months of your inbox to find all the subscription emails, and this user had a rather large number of emails.
That's an interesting one, thanks for the explanation.