Does OAuth app verification / CASA apply to a service account using ONLY domain-wide delegation (no consent screen, not on Marketplace)?

Google Workspace Developers Q&A
, , ,
1

Hi all,

We are building a multi-tenant SaaS that audits the security posture of our customers’ Google Workspace tenants (SMBs, roughly 30–300 users each). We asked Google Workspace Support about the verification requirements for our setup, and they told us this question is outside their scope and pointed us to this forum. I’d appreciate any guidance, especially from Googlers or developers who have been through this.

How we access customer data

  • A single service account in our Google Cloud project, using domain-wide delegation (DwD) to impersonate an admin in each customer tenant.
  • Each customer’s super admin registers our client ID and the scope list in Admin console → Security → API controls → Domain-wide delegation. That is the only authorization step.
  • There is no OAuth consent screen and no 3-legged OAuth flow anywhere in the product. End users never see a Google authorization prompt.
  • The app is not listed on Google Workspace Marketplace.
  • Data retrieved through the APIs is processed and stored on our own servers (Google Cloud, Japan region), so we are a “third-party server” in the sense of the restricted-scope policy.

Scopes we register

  • https://www.googleapis.com/auth/admin.reports.audit.readonly
  • https://www.googleapis.com/auth/admin.directory.user.readonly
  • https://www.googleapis.com/auth/admin.directory.user.security
  • https://www.googleapis.com/auth/admin.directory.group.readonly
  • https://www.googleapis.com/auth/admin.directory.domain.readonly
  • https://www.googleapis.com/auth/drive (restricted — used to inventory externally shared files and, when the customer’s admin enables it, to remove external sharing)

Questions

  1. Does OAuth app verification apply to a DwD-only app at all? The restricted-scope verification page says that domain-wide installation removes the need for brand verification, “however, if your app utilizes restricted or sensitive scopes, app verification is required.” App verification, as far as we can tell, is a process attached to an OAuth consent screen (branding, scope justification, a demo video of the consent flow). How does that requirement apply to a project that has no consent screen and never requests user consent?

  2. If verification is required, how is it actually submitted for this architecture? Would we need to configure a consent screen we don’t use, and record a demo video showing the Admin console DwD setup instead of a consent flow? Has anyone completed verification for a DwD-only service account?

  3. CASA. Since auth/drive is a restricted scope and we store data on our servers, would the CASA security assessment apply if we submit for verification? And conversely, is it correct that CASA is not triggered as long as no verification request is submitted?

  4. 100-user cap. Does the “OAuth user cap” for unverified apps requesting sensitive/restricted scopes apply in any way to a DwD service account? Our understanding is that it counts consent-screen grants, which never happen here.

  5. Customer-side API controls. If a customer has configured App access control to block unconfigured/unverified third-party apps, does that setting affect a client ID that the same admin has explicitly authorized under Domain-wide delegation? Or are the two mechanisms independent?

  6. Direction of travel. The DwD best-practices page recommends Marketplace apps or user-consent OAuth as alternatives. Is there any published guidance or timeline indicating that third-party SaaS products will be required to use Marketplace (admin install) rather than manual DwD registration?

We are planning to keep the DwD model for launch and evaluate a Marketplace listing (with full verification and CASA) as a later step, so any pointers on what is required vs. recommended would help us plan. Thank you.

1 Like