Hi Developers,
I’m having a frustrating issue with the OAuth consent setup for my website, where the application has been prepared for verification but the verification process does not appear to progress as expected. The website uses Google OAuth so visitors can sign in and grant the application access to the requested Google account information, and the OAuth flow itself works correctly for users during normal testing. I have configured the consent screen, added the required application information, provided the website and privacy-policy details, and reviewed the scopes being requested to make sure they match what the application actually needs. When I go through the verification submission process, however, the project remains in a state that makes it unclear whether the verification request has actually entered the review process. The Google Cloud console does not provide enough information for me to determine whether something in the submission is still incomplete or whether the request is simply waiting for review. I have already checked the basic configuration several times, but I am still unable to understand why the application is not moving forward after the verification request is submitted.
The confusing part is that I am not seeing an obvious configuration error that would explain why the verification status remains unchanged. The OAuth consent screen contains the application name, support contact information, developer contact information, authorized domain, homepage information, and privacy-policy URL, and the domain used by the application is the same domain that is associated with the website. I have also checked the authorized domains and redirect URI configuration to make sure the URLs being used by the website correspond to the OAuth client configuration in Google Cloud. During the actual login process, the user is redirected to Google, the consent screen appears, and after authorization the user is returned to the expected location on my website. Because the authorization flow itself is functioning, I initially assumed that the verification submission would proceed without any major issue. Instead, the verification section continues to leave me uncertain about the current state of the application. I do not want to repeatedly modify settings or submit new verification requests without understanding whether doing so could restart the review process or make the situation more complicated.
I have also reviewed the OAuth scopes because I understand that the type of information requested can affect whether an application requires verification. The application is only requesting the permissions that are necessary for the features implemented on my website, and I have tried to avoid requesting broader access than needed. I have checked the consent-screen configuration against the actual OAuth request generated by the website so that the scopes shown to Google users are consistent with the intended functionality. Despite doing this, I am still unsure whether the verification system considers something about the requested scopes or application configuration to be incomplete. There is no clear message telling me that a specific scope is causing the request to be rejected or that a particular piece of evidence needs to be provided. This makes troubleshooting difficult because I cannot tell whether I should be looking at the consent screen, the domain configuration, the OAuth client, the website itself, or the verification submission. I would rather identify the exact reason for the stalled status before making further changes, especially because changing OAuth configuration unnecessarily could introduce differences between the configuration used during testing and the configuration submitted for verification.
Another thing that makes this difficult is that the website is already publicly accessible and the URLs provided during the OAuth setup can be opened normally from an external browser. The homepage and privacy-policy page are available without requiring a Google login, and the information presented on those pages describes how the website uses the data requested through Google OAuth. I have also made sure that the application branding and website information are consistent rather than using unrelated names or domains in different parts of the configuration. From the website side, there does not appear to be anything preventing Google from reaching the relevant pages. I have tested the OAuth login more than once using a normal browser session and have confirmed that the authorization process can complete successfully. The issue is specifically that I cannot determine why the verification workflow does not seem to advance after submission. If there is a particular requirement that Google expects to be demonstrated before the review can begin, I would appreciate knowing where that requirement is displayed in the current Google Cloud console and how I can verify that it has actually been satisfied.
I have considered whether the problem could be related to the difference between testing the application and having it fully verified for production use, but I am not sure how the current status should be interpreted. The OAuth client can be used during development and testing, but I want the application to operate normally for users outside the test-user configuration without repeatedly encountering restrictions or warnings associated with an unverified application. I have therefore been trying to complete the verification process properly instead of relying on temporary testing arrangements. What I cannot determine is whether the request is genuinely waiting for Google’s review team, whether it has been submitted but requires additional action from me, or whether some part of the OAuth configuration is preventing the submission from being considered complete. I have checked the relevant sections in Google Cloud several times, but the status information does not seem specific enough to point me toward the next action. If anyone has recently gone through the OAuth app verification process and encountered a similar situation where the application remained in an apparently unchanged verification state despite having the consent screen, domain, privacy policy, and OAuth configuration prepared, I would really appreciate some guidance on what should be checked first.
At this point, I am mainly looking for a way to determine the exact state of the verification request and identify whether there is a missing requirement that is not being clearly surfaced in the console. I do not want to keep resubmitting the application or changing unrelated OAuth settings because the login flow itself is working and I would like to preserve the configuration that has already been tested successfully. Is there a particular section of the Google Cloud console where I can see whether the verification request is actually awaiting review, needs additional information, or failed validation before reaching the review stage? Also, if the application is using scopes that require verification, is there a recommended way to confirm that Google has received all of the required information and that the submitted website, privacy policy, authorized domain, and OAuth configuration are being evaluated as part of the same request? Any explanation of how the current verification status should be interpreted and what the correct next step is would be extremely helpful, because I want to resolve this through the proper verification process rather than making repeated configuration changes without knowing what is actually preventing the review from moving forward.