google-contacts-apigoogle-people-api

Will our Oauth Consent Screen have to go through verification again when adding contacts.other.readonly?


Our Google Oauth Consent Screen is currently verified and includes the

https://www.googleapis.com/auth/contacts scope.

We are now migrating to the People API and we want to have access to the

https://www.googleapis.com/auth/contacts.other.readonly scope.

If we add that to our Oauth Consent Screen, will that trigger a re-verification step?


Solution

  • Re-verification of the OAuth Consent Screen is required when adding sensitive scopes to the GCP Project. Both of these are sensitive scopes.

    Referring to this Support Article:

    Sensitive scopes

    Some of the scopes used by the following APIs are considered sensitive; see the API documentation or look for the lock icon in the Cloud Console. If your app requests sensitive scopes, and doesn't meet any of the criteria for an exception (see below), you will need to verify that your app follows the API Services User Data Policy.

    For a complete list of Google APIs, see OAuth 2.0 Scopes for Google APIs. To check if scopes are sensitive or restricted, add the scopes to your project via the Google Cloud Console.

    Addendum: Note that in People API the two scopes you are defining allow access to separate lists:

    https://www.googleapis.com/auth/contacts - Contacts list https://www.googleapis.com/auth/contacts.other.readonly - Other Contacts list

    enter image description here

    It's preferable to add both scopes.