We would like to clarify the scope-verification requirements for an operator-only Gmail integration before submitting a review.
Our application is a commercial ordering website. Its customers sign in to the ordering website independently and receive order/cancellation emails. They never authorize Google OAuth, connect a Google mailbox, or use Sign in with Google.
Only one designated business operator authorizes their own consumer Gmail account. The backend uses that account with https://www.googleapis.com/auth/gmail.send to send order and cancellation notifications. It does not read the mailbox. The only other requested scopes are openid and email to verify the operator’s identity. The OAuth project is External / In production, branding is verified and published, and there is one Google account that has granted OAuth access. Sensitive-scope verification has not been submitted, and general ordering is still closed.
The Sensitive scope verification documentation describes the Personal use exception for an app whose only user is the developer, or a few personally known users. We understand that the unverified-app user cap concerns Google accounts granting access, rather than email recipients.
- Does the Personal use verification exception apply to this owner-only OAuth integration even though the surrounding ordering website is commercial and has customers, or does this use require Sensitive Scope Verification?
- If verification is required, is the supported submission route the Verification Center with a demonstration of the operator’s OAuth grant and backend sending functionality?
- If a project-specific assessment is needed, what is the current official private contact channel for a Basic-support project? The address listed as the notification sender in the Brand Approvals help article rejected a new email with an address-not-found response, and the Cloud Console case-creation page returned an error. We do not want to misclassify this as a billing or emergency case, or submit an incomplete verification request only to open a conversation.
We are asking for clarification, not claiming that an exception has already been approved. No project identifiers, customer data, OAuth credentials or screenshots are included in this public question.