Non-sensitive
Brand verification
Non-sensitive scopes need brand verification when you want the app name and logo on the consent screen. They do not add a sensitive-scope review or an annual CASA assessment.
Public scope lists
What each OAuth scope asks of you
A searchable list of scopes app developers usually request. Tiers come from the published API scope pages. Where a page lists the scope and does not print a tier, the row says so.
Checked against the public docs on 2026-11-01.
Sensitive
Sensitive verification and a demo video
Sensitive scopes need brand verification, then a sensitive-scope review. The review asks for a demo video of the consent screen and of how the app uses the data.
Restricted
Restricted verification plus annual CASA
Restricted scopes include the sensitive-scope review and demo video, plus a security assessment (CASA) and annual re-verification.
84 scopes
| API | Scope | What it allows | Tier | Source |
|---|---|---|---|---|
| Sign-in | openid | Identify the signed-in account. Required at the start of an OpenID Connect request.Google Sign-In scopes are pre-filled in the non-sensitive section of the OAuth consent screen. | Non-sensitiveBrand verification | Docs |
| Sign-in | See the user's email address and whether it is verified.Google Sign-In scopes are pre-filled in the non-sensitive section of the OAuth consent screen. | Non-sensitiveBrand verification | Docs | |
| Sign-in | profile | See basic profile information, such as name and profile picture when the account shares them.Google Sign-In scopes are pre-filled in the non-sensitive section of the OAuth consent screen. | Non-sensitiveBrand verification | Docs |
| Sign-in | https://www.googleapis.com/auth/userinfo.email | See the primary email address of the Google Account.Google Sign-In scopes are pre-filled in the non-sensitive section of the OAuth consent screen. | Non-sensitiveBrand verification | Docs |
| Sign-in | https://www.googleapis.com/auth/userinfo.profile | See personal info the user has made available on the Google Account.Google Sign-In scopes are pre-filled in the non-sensitive section of the OAuth consent screen. | Non-sensitiveBrand verification | Docs |
| Gmail | https://www.googleapis.com/auth/gmail.addons.current.action.compose | Manage drafts and send emails when the user interacts with a Workspace add-on. | Non-sensitiveBrand verification | Docs |
| Gmail | https://www.googleapis.com/auth/gmail.addons.current.message.action | View email messages when the user interacts with a Workspace add-on. | Non-sensitiveBrand verification | Docs |
| Gmail | https://www.googleapis.com/auth/gmail.labels | See and edit email labels. | Non-sensitiveBrand verification | Docs |
| Gmail | https://www.googleapis.com/auth/gmail.addons.current.message.metadata | View email message metadata while a Workspace add-on is running. | SensitiveSensitive verification and a demo video | Docs |
| Gmail | https://www.googleapis.com/auth/gmail.addons.current.message.readonly | View email messages while a Workspace add-on is running. | SensitiveSensitive verification and a demo video | Docs |
| Gmail | https://www.googleapis.com/auth/gmail.send | Send email on the user's behalf. | SensitiveSensitive verification and a demo video | Docs |
| Gmail | https://mail.google.com/ | Read, compose, send, and permanently delete all email. Needed only for immediate permanent deletion that bypasses the trash. | RestrictedRestricted verification plus annual CASA | Docs |
| Gmail | https://www.googleapis.com/auth/gmail.readonly | View email messages and settings. | RestrictedRestricted verification plus annual CASA | Docs |
| Gmail | https://www.googleapis.com/auth/gmail.compose | Manage drafts and send emails. | RestrictedRestricted verification plus annual CASA | Docs |
| Gmail | https://www.googleapis.com/auth/gmail.insert | Add emails into the mailbox. | RestrictedRestricted verification plus annual CASA | Docs |
| Gmail | https://www.googleapis.com/auth/gmail.modify | Read, compose, and send email. Does not allow immediate permanent deletion that bypasses the trash. | RestrictedRestricted verification plus annual CASA | Docs |
| Gmail | https://www.googleapis.com/auth/gmail.metadata | View email metadata such as labels and headers, but not the message body. | RestrictedRestricted verification plus annual CASA | Docs |
| Gmail | https://www.googleapis.com/auth/gmail.settings.basic | See, edit, create, or change email settings and filters. | RestrictedRestricted verification plus annual CASA | Docs |
| Gmail | https://www.googleapis.com/auth/gmail.settings.sharing | Manage sensitive mail settings, including who can manage mail. Administrative use, with domain-wide delegation. | RestrictedRestricted verification plus annual CASA | Docs |
| Drive | https://www.googleapis.com/auth/drive.appdata | View and manage the app's own configuration data in Drive. | Non-sensitiveBrand verification | Docs |
| Drive | https://www.googleapis.com/auth/drive.appfolder | View and manage the app's own configuration data in Drive. Listed with drive.appdata. | Non-sensitiveBrand verification | Docs |
| Drive | https://www.googleapis.com/auth/drive.install | Let the app appear in the Open with or New menu. | Non-sensitiveBrand verification | Docs |
| Drive | https://www.googleapis.com/auth/drive.file | Create files, or modify files the user opens or picks for this app. Recommended non-sensitive scope for Docs, Sheets, and Slides. | Non-sensitiveBrand verification | Docs |
| Drive | https://www.googleapis.com/auth/drive.apps.readonly | View apps authorized to access Drive. | SensitiveSensitive verification and a demo video | Docs |
| Drive | https://www.googleapis.com/auth/drive | View and manage all Drive files. | RestrictedRestricted verification plus annual CASA | Docs |
| Drive | https://www.googleapis.com/auth/drive.readonly | View and download all Drive files. | RestrictedRestricted verification plus annual CASA | Docs |
| Drive | https://www.googleapis.com/auth/drive.activity | View and add to the activity record of files in Drive. | RestrictedRestricted verification plus annual CASA | Docs |
| Drive | https://www.googleapis.com/auth/drive.activity.readonly | View the activity record of files in Drive. | RestrictedRestricted verification plus annual CASA | Docs |
| Drive | https://www.googleapis.com/auth/drive.meet.readonly | View Drive files created or edited by Meet. | RestrictedRestricted verification plus annual CASA | Docs |
| Drive | https://www.googleapis.com/auth/drive.metadata | View and manage metadata of files in Drive. | RestrictedRestricted verification plus annual CASA | Docs |
| Drive | https://www.googleapis.com/auth/drive.metadata.readonly | View metadata for files in Drive. | RestrictedRestricted verification plus annual CASA | Docs |
| Drive | https://www.googleapis.com/auth/drive.scripts | Modify Apps Script project behavior. | RestrictedRestricted verification plus annual CASA | Docs |
| Docs | https://www.googleapis.com/auth/documents | See, edit, create, and delete all Docs documents. | SensitiveSensitive verification and a demo video | Docs |
| Docs | https://www.googleapis.com/auth/documents.readonly | See all Docs documents. | SensitiveSensitive verification and a demo video | Docs |
| Sheets | https://www.googleapis.com/auth/spreadsheets | See, edit, create, and delete all spreadsheets. | SensitiveSensitive verification and a demo video | Docs |
| Sheets | https://www.googleapis.com/auth/spreadsheets.readonly | See all spreadsheets. | SensitiveSensitive verification and a demo video | Docs |
| Slides | https://www.googleapis.com/auth/presentations | See, edit, create, and delete all presentations. | SensitiveSensitive verification and a demo video | Docs |
| Slides | https://www.googleapis.com/auth/presentations.readonly | See all presentations. | SensitiveSensitive verification and a demo video | Docs |
| Calendar | https://www.googleapis.com/auth/calendar | See, edit, share, and permanently delete all calendars the user can access.The Calendar scope page does not print a tier. The sensitive-scope verification guide uses reading calendar events as an example of a sensitive scope. Calendar is not named in the Workspace restricted-scope families (Gmail, Drive, Chat, Meet). | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| Calendar | https://www.googleapis.com/auth/calendar.readonly | See and download any calendar the user can access.The Calendar scope page does not print a tier. The sensitive-scope verification guide uses reading calendar events as an example of a sensitive scope. Calendar is not named in the Workspace restricted-scope families (Gmail, Drive, Chat, Meet). | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| Calendar | https://www.googleapis.com/auth/calendar.events | View and edit events on all calendars the user can access.The Calendar scope page does not print a tier. The sensitive-scope verification guide uses reading calendar events as an example of a sensitive scope. Calendar is not named in the Workspace restricted-scope families (Gmail, Drive, Chat, Meet). | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| Calendar | https://www.googleapis.com/auth/calendar.events.readonly | View events on all calendars the user can access.The Calendar scope page does not print a tier. The sensitive-scope verification guide uses reading calendar events as an example of a sensitive scope. Calendar is not named in the Workspace restricted-scope families (Gmail, Drive, Chat, Meet). | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| Calendar | https://www.googleapis.com/auth/calendar.events.owned | See, create, change, and delete events on calendars the user owns.The Calendar scope page does not print a tier. The sensitive-scope verification guide uses reading calendar events as an example of a sensitive scope. Calendar is not named in the Workspace restricted-scope families (Gmail, Drive, Chat, Meet). | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| Calendar | https://www.googleapis.com/auth/calendar.events.owned.readonly | See events on calendars the user owns.The Calendar scope page does not print a tier. The sensitive-scope verification guide uses reading calendar events as an example of a sensitive scope. Calendar is not named in the Workspace restricted-scope families (Gmail, Drive, Chat, Meet). | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| Calendar | https://www.googleapis.com/auth/calendar.calendarlist | See, add, and remove calendars the user is subscribed to.The Calendar scope page does not print a tier. The sensitive-scope verification guide uses reading calendar events as an example of a sensitive scope. Calendar is not named in the Workspace restricted-scope families (Gmail, Drive, Chat, Meet). | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| Calendar | https://www.googleapis.com/auth/calendar.calendarlist.readonly | See the list of calendars the user is subscribed to.The Calendar scope page does not print a tier. The sensitive-scope verification guide uses reading calendar events as an example of a sensitive scope. Calendar is not named in the Workspace restricted-scope families (Gmail, Drive, Chat, Meet). | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| Calendar | https://www.googleapis.com/auth/calendar.calendars | See and change calendar properties, and create secondary calendars.The Calendar scope page does not print a tier. The sensitive-scope verification guide uses reading calendar events as an example of a sensitive scope. Calendar is not named in the Workspace restricted-scope families (Gmail, Drive, Chat, Meet). | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| Calendar | https://www.googleapis.com/auth/calendar.calendars.readonly | See the title, description, time zone, and other properties of accessible calendars.The Calendar scope page does not print a tier. The sensitive-scope verification guide uses reading calendar events as an example of a sensitive scope. Calendar is not named in the Workspace restricted-scope families (Gmail, Drive, Chat, Meet). | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| Calendar | https://www.googleapis.com/auth/calendar.acls | See and change sharing permissions of calendars the user owns.The Calendar scope page does not print a tier. The sensitive-scope verification guide uses reading calendar events as an example of a sensitive scope. Calendar is not named in the Workspace restricted-scope families (Gmail, Drive, Chat, Meet). | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| Calendar | https://www.googleapis.com/auth/calendar.acls.readonly | See sharing permissions of calendars the user owns.The Calendar scope page does not print a tier. The sensitive-scope verification guide uses reading calendar events as an example of a sensitive scope. Calendar is not named in the Workspace restricted-scope families (Gmail, Drive, Chat, Meet). | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| Calendar | https://www.googleapis.com/auth/calendar.settings.readonly | View Calendar settings.The Calendar scope page does not print a tier. The sensitive-scope verification guide uses reading calendar events as an example of a sensitive scope. Calendar is not named in the Workspace restricted-scope families (Gmail, Drive, Chat, Meet). | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| Calendar | https://www.googleapis.com/auth/calendar.freebusy | View availability in the user's calendars.The Calendar scope page does not print a tier. The sensitive-scope verification guide uses reading calendar events as an example of a sensitive scope. Calendar is not named in the Workspace restricted-scope families (Gmail, Drive, Chat, Meet). | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| Calendar | https://www.googleapis.com/auth/calendar.events.freebusy | See availability on calendars the user can access.The Calendar scope page does not print a tier. The sensitive-scope verification guide uses reading calendar events as an example of a sensitive scope. Calendar is not named in the Workspace restricted-scope families (Gmail, Drive, Chat, Meet). | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| Calendar | https://www.googleapis.com/auth/calendar.addons.current.event.read | See the event the user has open in Calendar, from an add-on.The Calendar scope page does not print a tier. The sensitive-scope verification guide uses reading calendar events as an example of a sensitive scope. Calendar is not named in the Workspace restricted-scope families (Gmail, Drive, Chat, Meet). | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| Calendar | https://www.googleapis.com/auth/calendar.addons.current.event.write | Edit the event the user has open in Calendar, from an add-on.The Calendar scope page does not print a tier. The sensitive-scope verification guide uses reading calendar events as an example of a sensitive scope. Calendar is not named in the Workspace restricted-scope families (Gmail, Drive, Chat, Meet). | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| Calendar | https://www.googleapis.com/auth/calendar.app.created | Make secondary calendars, and see, create, change, and delete events on those calendars only.The Calendar scope page does not print a tier. This scope is narrower than full calendar access. Confirm the Cloud Console label before you treat it as non-sensitive. | Non-sensitiveBrand verificationConfirm in console | Docs |
| Calendar | https://www.googleapis.com/auth/calendar.events.public.readonly | See events on public calendars.The Calendar scope page does not print a tier. This scope is narrower than full calendar access. Confirm the Cloud Console label before you treat it as non-sensitive. | Non-sensitiveBrand verificationConfirm in console | Docs |
| Calendar | https://www.googleapis.com/auth/calendar.addons.execute | Run as a Calendar add-on.The Calendar scope page does not print a tier. This scope is narrower than full calendar access. Confirm the Cloud Console label before you treat it as non-sensitive. | Non-sensitiveBrand verificationConfirm in console | Docs |
| People | https://www.googleapis.com/auth/contacts | See, edit, download, and permanently delete contacts.The sensitive-scope verification guide gives storing a new contact as an example of a sensitive scope. | SensitiveSensitive verification and a demo video | Docs |
| People | https://www.googleapis.com/auth/contacts.readonly | See and download contacts.The OAuth scope index lists this scope and does not print a tier. It reads personal profile or contact data, so it is shown as sensitive. Confirm it in the Cloud Console. | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| People | https://www.googleapis.com/auth/contacts.other.readonly | See and download contact info saved in Other contacts.The OAuth scope index lists this scope and does not print a tier. It reads personal profile or contact data, so it is shown as sensitive. Confirm it in the Cloud Console. | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| People | https://www.googleapis.com/auth/directory.readonly | See and download the organization's Workspace directory.The OAuth scope index lists this scope and does not print a tier. It reads personal profile or contact data, so it is shown as sensitive. Confirm it in the Cloud Console. | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| People | https://www.googleapis.com/auth/user.addresses.read | View street addresses on the Google Account.The OAuth scope index lists this scope and does not print a tier. It reads personal profile or contact data, so it is shown as sensitive. Confirm it in the Cloud Console. | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| People | https://www.googleapis.com/auth/user.birthday.read | See the exact date of birth on the Google Account.The OAuth scope index lists this scope and does not print a tier. It reads personal profile or contact data, so it is shown as sensitive. Confirm it in the Cloud Console. | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| People | https://www.googleapis.com/auth/user.emails.read | See all email addresses on the Google Account.The OAuth scope index lists this scope and does not print a tier. It reads personal profile or contact data, so it is shown as sensitive. Confirm it in the Cloud Console. | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| People | https://www.googleapis.com/auth/user.gender.read | See gender on the Google Account.The OAuth scope index lists this scope and does not print a tier. It reads personal profile or contact data, so it is shown as sensitive. Confirm it in the Cloud Console. | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| People | https://www.googleapis.com/auth/user.organization.read | See education, work history, and organization info.The OAuth scope index lists this scope and does not print a tier. It reads personal profile or contact data, so it is shown as sensitive. Confirm it in the Cloud Console. | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| People | https://www.googleapis.com/auth/user.phonenumbers.read | See personal phone numbers on the Google Account.The OAuth scope index lists this scope and does not print a tier. It reads personal profile or contact data, so it is shown as sensitive. Confirm it in the Cloud Console. | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| Tasks | https://www.googleapis.com/auth/tasks | Create, edit, organize, and delete all tasks.The Tasks scope page lists this scope and does not print a tier. It is shown as sensitive because it covers the user's tasks. Confirm it in the Cloud Console. | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| Tasks | https://www.googleapis.com/auth/tasks.readonly | View tasks.The Tasks scope page lists this scope and does not print a tier. It is shown as sensitive because it covers the user's tasks. Confirm it in the Cloud Console. | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| YouTube | https://www.googleapis.com/auth/youtube.force-ssl | See, edit, and permanently delete videos, ratings, comments, and captions.The sensitive-scope verification guide gives deleting a YouTube video as an example of a sensitive scope. This scope includes permanently deleting videos. | SensitiveSensitive verification and a demo video | Docs |
| YouTube | https://www.googleapis.com/auth/youtube | Manage the YouTube account.The OAuth scope index lists this YouTube scope and does not print a tier. It is shown as sensitive. Confirm it in the Cloud Console. | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| YouTube | https://www.googleapis.com/auth/youtube.readonly | View the YouTube account.The OAuth scope index lists this YouTube scope and does not print a tier. It is shown as sensitive. Confirm it in the Cloud Console. | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| YouTube | https://www.googleapis.com/auth/youtube.upload | Manage YouTube videos.The OAuth scope index lists this YouTube scope and does not print a tier. It is shown as sensitive. Confirm it in the Cloud Console. | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| YouTube | https://www.googleapis.com/auth/youtube.channel-memberships.creator | See current channel members, their level, and when they joined.The OAuth scope index lists this YouTube scope and does not print a tier. It is shown as sensitive. Confirm it in the Cloud Console. | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| YouTube | https://www.googleapis.com/auth/yt-analytics.readonly | View YouTube Analytics reports for the user's content.The OAuth scope index lists this YouTube scope and does not print a tier. It is shown as sensitive. Confirm it in the Cloud Console. | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| YouTube | https://www.googleapis.com/auth/yt-analytics-monetary.readonly | View monetary and non-monetary YouTube Analytics reports.The OAuth scope index lists this YouTube scope and does not print a tier. It is shown as sensitive. Confirm it in the Cloud Console. | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| Photos | https://www.googleapis.com/auth/photospicker.mediaitems.readonly | Create, get, and delete Picker sessions, and list the media items in a session.The Photos authorization guide lists this scope and does not print a tier. Photos is not named in the Workspace restricted-scope families (Gmail, Drive, Chat, Meet). The broad library scopes are being removed; after 31 March 2025 only app-created content remains available. Picker access is limited to a session the user starts. The guide still does not label the tier. | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| Photos | https://www.googleapis.com/auth/photoslibrary.appendonly | Upload bytes, create media items, and add them to the user's library and to albums the app created.The Photos authorization guide lists this scope and does not print a tier. Photos is not named in the Workspace restricted-scope families (Gmail, Drive, Chat, Meet). The broad library scopes are being removed; after 31 March 2025 only app-created content remains available. | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| Photos | https://www.googleapis.com/auth/photoslibrary.readonly.appcreateddata | Read media items and albums created by this app.The Photos authorization guide lists this scope and does not print a tier. Photos is not named in the Workspace restricted-scope families (Gmail, Drive, Chat, Meet). The broad library scopes are being removed; after 31 March 2025 only app-created content remains available. App-created read access is narrower than the library. Confirm the label. | Non-sensitiveBrand verificationConfirm in console | Docs |
| Photos | https://www.googleapis.com/auth/photoslibrary.edit.appcreateddata | Edit albums and media items created by this app, including titles, descriptions, and album membership.The Photos authorization guide lists this scope and does not print a tier. Photos is not named in the Workspace restricted-scope families (Gmail, Drive, Chat, Meet). The broad library scopes are being removed; after 31 March 2025 only app-created content remains available. App-created edit access is narrower than the library. Confirm the label. | Non-sensitiveBrand verificationConfirm in console | Docs |
| Photos | https://www.googleapis.com/auth/photoslibrary.readonly | View the Google Photos library. This broad scope is being removed.The Photos authorization guide lists this scope and does not print a tier. Photos is not named in the Workspace restricted-scope families (Gmail, Drive, Chat, Meet). The broad library scopes are being removed; after 31 March 2025 only app-created content remains available. | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| Photos | https://www.googleapis.com/auth/photoslibrary | See, upload, and organize items in the Google Photos library. This broad scope is being removed.The Photos authorization guide lists this scope and does not print a tier. Photos is not named in the Workspace restricted-scope families (Gmail, Drive, Chat, Meet). The broad library scopes are being removed; after 31 March 2025 only app-created content remains available. | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
| Photos | https://www.googleapis.com/auth/photoslibrary.sharing | Manage and add to shared albums. This broad scope is being removed.The Photos authorization guide lists this scope and does not print a tier. Photos is not named in the Workspace restricted-scope families (Gmail, Drive, Chat, Meet). The broad library scopes are being removed; after 31 March 2025 only app-created content remains available. | SensitiveSensitive verification and a demo videoConfirm in console | Docs |
Sources: the Gmail, Drive, Docs, Sheets, Slides, Calendar, Tasks, and Photos scope guides, the OAuth scope index, the OpenID Connect guide, the sensitive-scope verification guide, and the Workspace user data policy. YouTube partner scopes are omitted because those pages do not label a tier. Add-on-only scopes that are on the Gmail page are included. This table is not the Cloud Console. The console classification is the one that gates your project.