Justify the gmail.send scope for OAuth verification
If your app only sends email on the user's behalf, gmail.send is the scope you want — it's sensitive (justifiable with a video) rather than restricted (which needs a separate security assessment).
Builders often reach for a broad Gmail scope when all they do is send a message. gmail.send is send-only: no inbox reading, which keeps it in the sensitive tier you can justify with a per-feature explanation and a demo video. The read/modify Gmail scopes are restricted — they require a security assessment by Google-empanelled assessors (CASA). Choosing send-only when that's all you need is the difference between a template-able justification and a whole separate assessment track.
Each fix below traces to a requirement Google publishes.
Nothing here is our opinion. Every requirement links to Google’s own page — open it and verify the fix yourself before you resubmit.
“Every requested scope is classified non-sensitive, sensitive, or restricted — the category is shown per scope in the Cloud Console, and it decides your verification path.”
“Restricted scopes require a security assessment by Google-empanelled assessors under the CASA framework, with a Letter of Assessment renewed at least every 12 months.”
“Give one justification per sensitive scope, each tied to a specific feature a user can see.”
“Where a narrower scope exists, either switch to it or explain why it won't do — over-asking without a justification is itself a rejection ground.”
“Declare every scope your code actually requests — an undeclared runtime scope is a rejection.”
Do these in order.
- 01
Confirm you only send
If your app never reads, searches, or modifies the inbox, gmail.send is the correct scope. It sends mail as the user without inbox access.
- 02
Tie it to the sending feature
Justify it against the visible feature: 'send the invoice email the user composed in our app from their own address'. One scope, one feature.
- 03
Stay out of the restricted tier
Avoid gmail.readonly / gmail.modify / full Gmail unless you truly must read the mailbox — those are restricted and require a CASA security assessment, not a justification.
- 04
Demonstrate it in the video
Show the send action in your demo video, and make sure gmail.send is declared on the consent screen exactly as your code requests it.
What each scope actually grants.
The tier decides your path: non-sensitive needs only brand verification, sensitive needs a justification and demo video, and restricted needs a separate security assessment. Google’s scope categories →
| Scope | Tier | What it accesses |
|---|---|---|
| gmail.send | Sensitive | Send email on the user's behalf (no inbox read) |
See exactly what Google’s crawler sees — free.
Paste your URL and scopes. The pre-check fetches your homepage the way Google does, finds your privacy-policy link, and flags the blockers this rejection is about — in seconds, no signup.
Straight answers.
Is gmail.send restricted or sensitive?
Sensitive. Because it only sends mail and can't read the inbox, it's justifiable with a per-feature explanation and a demo video — no CASA assessment, unlike the read/modify Gmail scopes.
How do I avoid the restricted Gmail path?
Request gmail.send if you only send email. The restricted tier (gmail.readonly, gmail.modify, full Gmail) is for reading or managing the mailbox and triggers a security assessment.