OAuth verification blocked: homepage requirement contradicts review status (homepage publicly accessible)

[350d]

Hi Google Identity team

I’m currently stuck in the OAuth verification process and I’m facing a contradiction in the review results that I can’t resolve on my side.

Context

• App type: OAuth (Google Sign-In)

• Verification section status:

  • Privacy Policy — approved

  • Branding Guidelines — approved

  • Homepage requirements — failed

The reported issue is:

Why this seems incorrect

• The homepage is publicly accessible, no authentication required

• Login / Sign Up buttons exist, but do not block content

• The page clearly explains:

  • what the service does

  • supported platforms

  • how OAuth is used

• I verified the page via:

  • incognito mode

  • different IPs

  • public screenshot services (no cookies / auth)

• What I’ve tried to do already:

  • tried to add ?v2, /index.php etc. to app url and resubmit verification

  • answered to Google Team email two times in two days timeframe

  • Cloudflare protection turned off (developer mode, no security rules)

The reviewer also successfully found and approved links to:

• Privacy Policy

• Branding information

which are available only via the same public homepage, so the page is clearly reachable without login.

URLs

• Homepage: https://rtmps.io

• Privacy Policy: available in footer

• Terms of Service: available in footer

Question

What exactly qualifies as “behind a login page” in this context?

Specifically:

• Is the presence of OAuth buttons (Continue with Google / Apple) considered a blocker?

• Is Google expecting a separate marketing / landing page without any auth-related UI?

• Is there an automated check that may be misclassifying the page?

At this point, the feedback doesn’t provide any actionable change, since the requirement already appears to be met.

Any clarification from the Identity / Trust & Safety team would be greatly appreciated

Thanks!

[leo_saed]

Have you tried to Ensure that Google’s review bot/team isn’t being blocked by:

IP whitelisting.

Basic Auth (the browser popup asking for a username/password).

Robot.txt files that forbid all crawling

[350d]

All protection disabled via Cloudflare dashboard (development mode) and extra security rule added to skip everything. Page are not published anywhere and not indexed yet - so I can see there is no any blocked requests available for several days already. Robots.txt are empty.
Also as you can see — google can check for ToS/Policy links on the page, so its available for view.