OAuth: business.manage shown as "non-sensitive" in Auth Platform, but backend blocks ALL external users with Error 403 access_denied — no Submit-for-Verification path exists

Google Cloud Cloud Foundations & Onboarding
1

Summary
Google’s Auth Platform classifies https://www.googleapis.com/auth/business.manage as a NON-SENSITIVE scope for my project, so the Verification Center offers nothing to submit. But the OAuth backend enforces the scope as verification-required and hard-blocks every external (non-test) user at consent with Error 403: access_denied. There is no way to submit for verification through the console, so the app can never be approved. This appears to be a scope-classification bug on Google’s side.

Environment

  • App name: Valian
  • Project number: (PII Removed by Staff)
  • OAuth client_id: (PII Removed by Staff)
  • User type: External | Publishing status: In production
  • Branding: Verified (“being shown to users”)
  • Project Checkup: all green, including “OAuth app verification: Your app has been verified by Google”
  • Only requested scope: https://www.googleapis.com/auth/business.manage (listed under “non-sensitive scopes”)

Expected
Either (a) the scope is treated as non-sensitive and external users can grant it in production without verification, OR (b) it is treated as verification-required and the console surfaces a Submit-for-Verification action so I can complete verification.

Actual
Neither. The console says no verification is required and shows the app as verified, yet every external non-test user is blocked at consent:

“Access blocked: valiansystems.com has not completed the Google verification process. The app is currently being tested, and can only be accessed by developer-approved testers. Error 403: access_denied.”

Request details from that attempt:

Steps to reproduce

  1. Configure an OAuth app (External, In production) requesting only business.manage.
  2. Observe the scope is classified “non-sensitive” and the Verification Center shows nothing to submit.
  3. Attempt the OAuth flow with any external, non-test Google account.
  4. Result: Error 403 access_denied (“app is currently being tested / developer-approved testers only”).

What I’ve verified

  • Google My Business API is enabled in the project.
  • Branding is verified; (URL Removed by Staff) domain is confirmed.
  • Only business.manage is requested; no sensitive/restricted scope is present.
  • Test users complete the flow fine; only external users are blocked.
  • Google Business Profile support (case 2-8673000041103) confirmed they cannot reclassify scopes or initiate verification, and directed me to the Auth Platform team.

Ask
Please correctly classify business.manage as a verification-required scope for this project so it enters the Verification Center, OR initiate verification from Google’s side. As-is, there is no console path to get this approved, and it blocks a live production feature.

1 Like