Google Denying Request for Sensitive GMail ScopeIs there a link to the “latest” jQuery library on Google APIs?www.googleapis.com/userinfo/email returns different result depending on scopesGoogle OAuth scope for sending mailGoogle get email proper scopesCan't read phone numbers from user's google profile using - auth/user.phonenumbers.read scopeGoogle OAuth Developer Verification form submitted but no response from googleI received an email titled: [Action Required] Policy Changes for Projects that Use Restricted Gmail API ScopesScopes added to Gmail API project aren't reflected in OAuth consent screenWhere is the list of which Google OAuth2 scopes are considered “sensitive”?Google OAuth - Get uers email address after authentication. (And after Google+ is deprecated)
Is there a list of world wide upcoming space events on the web?
Does the app TikTok violate trademark?
What's the hidden joke/meaning behind "Don't drink and park - accidents cause people"?
What happens to a net with the Returning Weapon artificer infusion after it hits?
Is it ok if I haven't decided my research topic when I first meet with a potential phd advisor?
Why is a road bike faster than a city bike with the same effort? How much faster it can be?
I reverse the source code, you reverse the input!
rust-proof solution for attaching 2x4 to 4x4?
Why does my browser attempt to download pages from http://clhs.lisp.se instead of viewing them normally?
Lost passport and visa, tried to reapply, got rejected twice. What are my next steps?
After viewing logs with journalctl, how do I exit the screen that says "lines 1-2/2 (END)"?
Dynamic DataSource for Droplist in Content Editor
Are the coefficients of certain product of Rogers-Ramanujan Continued Fraction non-negative?
Where to find the Arxiv endorsement code?
If a spaceship ran out of fuel somewhere in space between Earth and Mars, does it slowly drift off to the Sun?
Pushing the e-pawn
"I will not" or "I don't" as an answer for negative orders?
Assembly of PCBs containing a mix of SMT and thru-hole parts?
Avoiding dust scattering when you drill
What does `idem` mean in the VIM docs?
What in my code changed between MacTeX 2017 and MacTex 2019?
Can I build a half bath without permits?
Why is the Common Agricultural Policy unfavourable to the UK?
LM324 - Issue with output in negative feedback
Google Denying Request for Sensitive GMail Scope
Is there a link to the “latest” jQuery library on Google APIs?www.googleapis.com/userinfo/email returns different result depending on scopesGoogle OAuth scope for sending mailGoogle get email proper scopesCan't read phone numbers from user's google profile using - auth/user.phonenumbers.read scopeGoogle OAuth Developer Verification form submitted but no response from googleI received an email titled: [Action Required] Policy Changes for Projects that Use Restricted Gmail API ScopesScopes added to Gmail API project aren't reflected in OAuth consent screenWhere is the list of which Google OAuth2 scopes are considered “sensitive”?Google OAuth - Get uers email address after authentication. (And after Google+ is deprecated)
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;
About 3 months ago I got an email from Google telling me their rules for using sensitive scopes for GMail changed. Now virtually all GMail scopes are "sensitive".
My application (which runs on an IBM i system, in the past know an iSeries, AS/400, etc) was using:
https://mail.google.com/
So once I got that, I did some research and found out the least common scope I required was:
/auth/gmail.modify
This was mainly so that a user could mark a message as "read" after downloading email to their system.
The application is used to download emails from their account and process the emails, attachments and other parts.
Well, Google and I went back and forth with what seemed like robotic emails from Google asking for this and that, videos that show the OAuth authentication, use of the app, etc. I provided everything they asked. Of course each reply took 2-3 weeks each time.
They asked for the videos again making sure the client ID was in the video for OAuth Authentication. I did that again, and in the video paused and highlighted this information.
After about 3 rounds of "we're sorry, your video is insufficient, please provide another one" I pleaded to speak to someone on the phone or directly as this isn't a normal app on a phone/device. It's on a mainframe system used by businesses that doesn't have a native browser available. The authentication starts on a traditional "terminal/green screen" and then takes over from a URL on my site (using HTTPS all the way through).
Well, today they turned down the request stating it didn't meet their specifications, but of course no other explanations. I have read their rules many times and I don't see where they are coming from.
How can I have a reasonable conversation with a huge company if they don't even understand the system it's run on and different that every other app?
I imagine the response is "they can do what they want". But this is sort of ridiculous and I'm sure the person reviewing it didn't know what they were watching.
Here are the videos if anyone wants context:
The First video (https://www.youtube.com/watch?v=a6Ips7eOqbs) I showed CLEARLY the client ID and setting up OAuth 2.0 for user.
The 2nd video (https://www.youtube.com/watch?v=g1v_ledW4cQ) shows how it retrieves messages and parts, marks them as read (which requires the modify scope).
google-api google-oauth google-developers-console
asked Mar 28 at 19:22
bvstonebvstone
3703 silver badges14 bronze badges
add a comment
|
About 3 months ago I got an email from Google telling me their rules for using sensitive scopes for GMail changed. Now virtually all GMail scopes are "sensitive".
My application (which runs on an IBM i system, in the past know an iSeries, AS/400, etc) was using:
https://mail.google.com/
So once I got that, I did some research and found out the least common scope I required was:
/auth/gmail.modify
This was mainly so that a user could mark a message as "read" after downloading email to their system.
The application is used to download emails from their account and process the emails, attachments and other parts.
Well, Google and I went back and forth with what seemed like robotic emails from Google asking for this and that, videos that show the OAuth authentication, use of the app, etc. I provided everything they asked. Of course each reply took 2-3 weeks each time.
They asked for the videos again making sure the client ID was in the video for OAuth Authentication. I did that again, and in the video paused and highlighted this information.
After about 3 rounds of "we're sorry, your video is insufficient, please provide another one" I pleaded to speak to someone on the phone or directly as this isn't a normal app on a phone/device. It's on a mainframe system used by businesses that doesn't have a native browser available. The authentication starts on a traditional "terminal/green screen" and then takes over from a URL on my site (using HTTPS all the way through).
Well, today they turned down the request stating it didn't meet their specifications, but of course no other explanations. I have read their rules many times and I don't see where they are coming from.
How can I have a reasonable conversation with a huge company if they don't even understand the system it's run on and different that every other app?
I imagine the response is "they can do what they want". But this is sort of ridiculous and I'm sure the person reviewing it didn't know what they were watching.
Here are the videos if anyone wants context:
The First video (https://www.youtube.com/watch?v=a6Ips7eOqbs) I showed CLEARLY the client ID and setting up OAuth 2.0 for user.
The 2nd video (https://www.youtube.com/watch?v=g1v_ledW4cQ) shows how it retrieves messages and parts, marks them as read (which requires the modify scope).
google-api google-oauth google-developers-console
asked Mar 28 at 19:22
bvstonebvstone
3703 silver badges14 bronze badges
I just realized the scope mail.google.com is also required for OAuth 2.0 authentication using Googles SMTP server as well. That is a recent as February 2019 in their documentation. Is this an example of the right hand not knowing what the left is doing? I remember a few years ago I was able to get in contact with someone at Google fairly easily to report their expired SSL CAs for the serverrs (happened 2 years in a row). But now this? I don't understand them not allowing the use of almost all gmail scopes for developers, especially those of us creating solutions for businesses.
– bvstone
Mar 30 at 13:12
Based on what you shared, I see two issues. Firstly, your first video doesn't show the entireclient_id. That's easy to fix: you should expand your browser window to display the entire thing. I made a sample video with some tips here...
– Graeme
Apr 1 at 19:13
Also, Google recently promoted all GMail scopes from "Sensitive" to "Restricted". This is a major change that restricts the types of applications that are allowed to use the data as well as the process for verifying apps that may qualify to use these scopes. Review the Restricted Scope App Verification section of the OAuth Verification FAQ to determine which category your app falls into.
– Graeme
Apr 1 at 19:13
I highlighted it in video. Why would I hide purposely the id? If that was the issue I would have hoped they would have said that was the issue. I think they overlooked the fact that the SMTP server, when using OAuth 2.0 authentication, requires the most sensitive and encompassing scope. So, still looking for ideas. I did resubmit explaining it's required for SMTP. PS - They also asked me a lot of questions that proved to me they had NO idea the platform this was on. Which is why I requested many times to speak with someone one on one instead of the boilerplate questions.
– bvstone
Apr 1 at 23:40
add a comment
|
About 3 months ago I got an email from Google telling me their rules for using sensitive scopes for GMail changed. Now virtually all GMail scopes are "sensitive".
My application (which runs on an IBM i system, in the past know an iSeries, AS/400, etc) was using:
https://mail.google.com/
So once I got that, I did some research and found out the least common scope I required was:
/auth/gmail.modify
This was mainly so that a user could mark a message as "read" after downloading email to their system.
The application is used to download emails from their account and process the emails, attachments and other parts.
Well, Google and I went back and forth with what seemed like robotic emails from Google asking for this and that, videos that show the OAuth authentication, use of the app, etc. I provided everything they asked. Of course each reply took 2-3 weeks each time.
They asked for the videos again making sure the client ID was in the video for OAuth Authentication. I did that again, and in the video paused and highlighted this information.
After about 3 rounds of "we're sorry, your video is insufficient, please provide another one" I pleaded to speak to someone on the phone or directly as this isn't a normal app on a phone/device. It's on a mainframe system used by businesses that doesn't have a native browser available. The authentication starts on a traditional "terminal/green screen" and then takes over from a URL on my site (using HTTPS all the way through).
Well, today they turned down the request stating it didn't meet their specifications, but of course no other explanations. I have read their rules many times and I don't see where they are coming from.
How can I have a reasonable conversation with a huge company if they don't even understand the system it's run on and different that every other app?
I imagine the response is "they can do what they want". But this is sort of ridiculous and I'm sure the person reviewing it didn't know what they were watching.
Here are the videos if anyone wants context:
The First video (https://www.youtube.com/watch?v=a6Ips7eOqbs) I showed CLEARLY the client ID and setting up OAuth 2.0 for user.
The 2nd video (https://www.youtube.com/watch?v=g1v_ledW4cQ) shows how it retrieves messages and parts, marks them as read (which requires the modify scope).
google-api google-oauth google-developers-console
asked Mar 28 at 19:22
bvstonebvstone
3703 silver badges14 bronze badges
About 3 months ago I got an email from Google telling me their rules for using sensitive scopes for GMail changed. Now virtually all GMail scopes are "sensitive".
My application (which runs on an IBM i system, in the past know an iSeries, AS/400, etc) was using:
https://mail.google.com/
So once I got that, I did some research and found out the least common scope I required was:
/auth/gmail.modify
This was mainly so that a user could mark a message as "read" after downloading email to their system.
The application is used to download emails from their account and process the emails, attachments and other parts.
Well, Google and I went back and forth with what seemed like robotic emails from Google asking for this and that, videos that show the OAuth authentication, use of the app, etc. I provided everything they asked. Of course each reply took 2-3 weeks each time.
They asked for the videos again making sure the client ID was in the video for OAuth Authentication. I did that again, and in the video paused and highlighted this information.
After about 3 rounds of "we're sorry, your video is insufficient, please provide another one" I pleaded to speak to someone on the phone or directly as this isn't a normal app on a phone/device. It's on a mainframe system used by businesses that doesn't have a native browser available. The authentication starts on a traditional "terminal/green screen" and then takes over from a URL on my site (using HTTPS all the way through).
Well, today they turned down the request stating it didn't meet their specifications, but of course no other explanations. I have read their rules many times and I don't see where they are coming from.
How can I have a reasonable conversation with a huge company if they don't even understand the system it's run on and different that every other app?
I imagine the response is "they can do what they want". But this is sort of ridiculous and I'm sure the person reviewing it didn't know what they were watching.
Here are the videos if anyone wants context:
The First video (https://www.youtube.com/watch?v=a6Ips7eOqbs) I showed CLEARLY the client ID and setting up OAuth 2.0 for user.
The 2nd video (https://www.youtube.com/watch?v=g1v_ledW4cQ) shows how it retrieves messages and parts, marks them as read (which requires the modify scope).
google-api google-oauth google-developers-console
google-api google-oauth google-developers-console
asked Mar 28 at 19:22
bvstonebvstone
3703 silver badges14 bronze badges
asked Mar 28 at 19:22
bvstonebvstone
3703 silver badges14 bronze badges
asked Mar 28 at 19:22
bvstonebvstone
3703 silver badges14 bronze badges
asked Mar 28 at 19:22
bvstonebvstone
3703 silver badges14 bronze badges
asked Mar 28 at 19:22
bvstonebvstone
3703 silver badges14 bronze badges
3703 silver badges14 bronze badges
I just realized the scope mail.google.com is also required for OAuth 2.0 authentication using Googles SMTP server as well. That is a recent as February 2019 in their documentation. Is this an example of the right hand not knowing what the left is doing? I remember a few years ago I was able to get in contact with someone at Google fairly easily to report their expired SSL CAs for the serverrs (happened 2 years in a row). But now this? I don't understand them not allowing the use of almost all gmail scopes for developers, especially those of us creating solutions for businesses.
– bvstone
Mar 30 at 13:12
Based on what you shared, I see two issues. Firstly, your first video doesn't show the entireclient_id. That's easy to fix: you should expand your browser window to display the entire thing. I made a sample video with some tips here...
– Graeme
Apr 1 at 19:13
Also, Google recently promoted all GMail scopes from "Sensitive" to "Restricted". This is a major change that restricts the types of applications that are allowed to use the data as well as the process for verifying apps that may qualify to use these scopes. Review the Restricted Scope App Verification section of the OAuth Verification FAQ to determine which category your app falls into.
– Graeme
Apr 1 at 19:13
I highlighted it in video. Why would I hide purposely the id? If that was the issue I would have hoped they would have said that was the issue. I think they overlooked the fact that the SMTP server, when using OAuth 2.0 authentication, requires the most sensitive and encompassing scope. So, still looking for ideas. I did resubmit explaining it's required for SMTP. PS - They also asked me a lot of questions that proved to me they had NO idea the platform this was on. Which is why I requested many times to speak with someone one on one instead of the boilerplate questions.
– bvstone
Apr 1 at 23:40
add a comment
|
I just realized the scope mail.google.com is also required for OAuth 2.0 authentication using Googles SMTP server as well. That is a recent as February 2019 in their documentation. Is this an example of the right hand not knowing what the left is doing? I remember a few years ago I was able to get in contact with someone at Google fairly easily to report their expired SSL CAs for the serverrs (happened 2 years in a row). But now this? I don't understand them not allowing the use of almost all gmail scopes for developers, especially those of us creating solutions for businesses.
– bvstone
Mar 30 at 13:12
Based on what you shared, I see two issues. Firstly, your first video doesn't show the entireclient_id. That's easy to fix: you should expand your browser window to display the entire thing. I made a sample video with some tips here...
– Graeme
Apr 1 at 19:13
Also, Google recently promoted all GMail scopes from "Sensitive" to "Restricted". This is a major change that restricts the types of applications that are allowed to use the data as well as the process for verifying apps that may qualify to use these scopes. Review the Restricted Scope App Verification section of the OAuth Verification FAQ to determine which category your app falls into.
– Graeme
Apr 1 at 19:13
I highlighted it in video. Why would I hide purposely the id? If that was the issue I would have hoped they would have said that was the issue. I think they overlooked the fact that the SMTP server, when using OAuth 2.0 authentication, requires the most sensitive and encompassing scope. So, still looking for ideas. I did resubmit explaining it's required for SMTP. PS - They also asked me a lot of questions that proved to me they had NO idea the platform this was on. Which is why I requested many times to speak with someone one on one instead of the boilerplate questions.
– bvstone
Apr 1 at 23:40
I just realized the scope mail.google.com is also required for OAuth 2.0 authentication using Googles SMTP server as well. That is a recent as February 2019 in their documentation. Is this an example of the right hand not knowing what the left is doing? I remember a few years ago I was able to get in contact with someone at Google fairly easily to report their expired SSL CAs for the serverrs (happened 2 years in a row). But now this? I don't understand them not allowing the use of almost all gmail scopes for developers, especially those of us creating solutions for businesses.
– bvstone
Mar 30 at 13:12
I just realized the scope mail.google.com is also required for OAuth 2.0 authentication using Googles SMTP server as well. That is a recent as February 2019 in their documentation. Is this an example of the right hand not knowing what the left is doing? I remember a few years ago I was able to get in contact with someone at Google fairly easily to report their expired SSL CAs for the serverrs (happened 2 years in a row). But now this? I don't understand them not allowing the use of almost all gmail scopes for developers, especially those of us creating solutions for businesses.
– bvstone
Mar 30 at 13:12
Based on what you shared, I see two issues. Firstly, your first video doesn't show the entire
client_id. That's easy to fix: you should expand your browser window to display the entire thing. I made a sample video with some tips here...– Graeme
Apr 1 at 19:13
Based on what you shared, I see two issues. Firstly, your first video doesn't show the entire
client_id. That's easy to fix: you should expand your browser window to display the entire thing. I made a sample video with some tips here...– Graeme
Apr 1 at 19:13
Also, Google recently promoted all GMail scopes from "Sensitive" to "Restricted". This is a major change that restricts the types of applications that are allowed to use the data as well as the process for verifying apps that may qualify to use these scopes. Review the Restricted Scope App Verification section of the OAuth Verification FAQ to determine which category your app falls into.
– Graeme
Apr 1 at 19:13
Also, Google recently promoted all GMail scopes from "Sensitive" to "Restricted". This is a major change that restricts the types of applications that are allowed to use the data as well as the process for verifying apps that may qualify to use these scopes. Review the Restricted Scope App Verification section of the OAuth Verification FAQ to determine which category your app falls into.
– Graeme
Apr 1 at 19:13
I highlighted it in video. Why would I hide purposely the id? If that was the issue I would have hoped they would have said that was the issue. I think they overlooked the fact that the SMTP server, when using OAuth 2.0 authentication, requires the most sensitive and encompassing scope. So, still looking for ideas. I did resubmit explaining it's required for SMTP. PS - They also asked me a lot of questions that proved to me they had NO idea the platform this was on. Which is why I requested many times to speak with someone one on one instead of the boilerplate questions.
– bvstone
Apr 1 at 23:40
I highlighted it in video. Why would I hide purposely the id? If that was the issue I would have hoped they would have said that was the issue. I think they overlooked the fact that the SMTP server, when using OAuth 2.0 authentication, requires the most sensitive and encompassing scope. So, still looking for ideas. I did resubmit explaining it's required for SMTP. PS - They also asked me a lot of questions that proved to me they had NO idea the platform this was on. Which is why I requested many times to speak with someone one on one instead of the boilerplate questions.
– bvstone
Apr 1 at 23:40
add a comment
|
0
active
oldest
votes
Your Answer
StackExchange.ifUsing("editor", function ()
StackExchange.using("externalEditor", function ()
StackExchange.using("snippets", function ()
StackExchange.snippets.init();
);
);
, "code-snippets");
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "1"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/4.0/"u003ecc by-sa 4.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f55405409%2fgoogle-denying-request-for-sensitive-gmail-scope%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f55405409%2fgoogle-denying-request-for-sensitive-gmail-scope%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
I just realized the scope mail.google.com is also required for OAuth 2.0 authentication using Googles SMTP server as well. That is a recent as February 2019 in their documentation. Is this an example of the right hand not knowing what the left is doing? I remember a few years ago I was able to get in contact with someone at Google fairly easily to report their expired SSL CAs for the serverrs (happened 2 years in a row). But now this? I don't understand them not allowing the use of almost all gmail scopes for developers, especially those of us creating solutions for businesses.
– bvstone
Mar 30 at 13:12
Based on what you shared, I see two issues. Firstly, your first video doesn't show the entire
client_id. That's easy to fix: you should expand your browser window to display the entire thing. I made a sample video with some tips here...– Graeme
Apr 1 at 19:13
Also, Google recently promoted all GMail scopes from "Sensitive" to "Restricted". This is a major change that restricts the types of applications that are allowed to use the data as well as the process for verifying apps that may qualify to use these scopes. Review the Restricted Scope App Verification section of the OAuth Verification FAQ to determine which category your app falls into.
– Graeme
Apr 1 at 19:13
I highlighted it in video. Why would I hide purposely the id? If that was the issue I would have hoped they would have said that was the issue. I think they overlooked the fact that the SMTP server, when using OAuth 2.0 authentication, requires the most sensitive and encompassing scope. So, still looking for ideas. I did resubmit explaining it's required for SMTP. PS - They also asked me a lot of questions that proved to me they had NO idea the platform this was on. Which is why I requested many times to speak with someone one on one instead of the boilerplate questions.
– bvstone
Apr 1 at 23:40