I need help diagnosing a prototype app’s user access. The creator account is on the Free plan. The app was copied under the same creator account without copying the data, and remains Not Deployed.
Observed behavior:
- Five individual Google accounts are now listed as Use app / User / Latest. The entries persist after closing and reloading the editor.
- Four tested accounts receive Access Denied. The fifth account has not tested yet. The error page identifies the expected signed-in email and app; both the requested and actual authentication provider are Google.
- The audit log records successful AppSubscriberChangeEvent entries, followed by real-user App sync failures with
App Access Denied: true. It gives no further cause. - Explicitly selecting Latest did not resolve one user’s failure. That user’s grant was then removed and recreated, but no post-recreation attempt is available yet.
- A different test account was freshly added and then assigned Latest. Its actual login failed after those successful grant changes, despite the grant remaining visible after reload.
- Creator access and Preview app as can load the app. A controlled request/edit/save test in preview succeeded and its test data was restored, but this does not validate real-user authentication.
Checks completed:
- Require user sign-in is enabled, provider Google; Allow all signed-in users and Domain Authentication are disabled.
- Personal use only is disabled. All 22 tables use as app creator.
- Account App Info currently reports 0, 4, and 5 monthly users for its three apps; none is shown above 10.
- Deployment checks pass sign-in and allowed updates. They report plan requirements for deployment and explicitly state that testing is permitted. There is also a separate table column-count warning; no causal link to the access denial is established.
- One affected Google account successfully synced the original app earlier the same day.
How can we diagnose why real-user authorization rejects these persisted individual grants? Is there an additional app/account access status to inspect, and what evidence should be provided through a private support channel? We have retained grant-event and failed-sync timestamps and trace IDs privately.
We have kept sign-in and individual access restrictions enabled and have not made the app public.