Gmail API-specific authorization and authentication information

This document contains Gmail API-specific authorization and authentication information . Before reading this document, be sure to read the general authentication and authorization information at Develop on Google Workspace.

Authorization scopes express the permissions you request users to authorize for your app. As a general rule, choose the most narrowly focused scope possible, and avoid requesting scopes that your app doesn't actually need. Users more readily grant access to limited, clearly described scopes.

If your public application uses scopes that permit access to certain user data, it must complete a verification process. If you see unverified app on the screen when testing your application, you must submit a verification request to remove it. Find out more about unverified apps and get answers to frequently asked questions about app verification in the Help Center.

Gmail scopes

The Gmail API supports the following scopes:

Scope code	Description	Usage
https://www.googleapis.com/auth/gmail.labels	Create, read, update, and delete labels only.	Recommended
https://www.googleapis.com/auth/gmail.send	Send messages only. No read or modify privileges on mailbox.	Sensitive
https://www.googleapis.com/auth/gmail.readonly	Read all resources and their metadata—no write operations.	Restricted
https://www.googleapis.com/auth/gmail.compose	Create, read, update, and delete drafts. Send messages and drafts.	Restricted
https://www.googleapis.com/auth/gmail.insert	Insert and import messages only.	Restricted
https://www.googleapis.com/auth/gmail.modify	All read/write operations except immediate, permanent deletion of threads and messages, bypassing Trash.	Restricted
https://www.googleapis.com/auth/gmail.metadata	Read resources metadata including labels, history records, and email message headers, but not the message body or attachments.	Restricted
https://www.googleapis.com/auth/gmail.settings.basic	Manage basic mail settings.	Restricted
https://www.googleapis.com/auth/gmail.settings.sharing	Manage sensitive mail settings, including forwarding rules and aliases. Note:Operations guarded by this scope are restricted to administrative use only. They are only available to Google Workspace customers using a service account with domain-wide delegation.	Restricted
https://mail.google.com/	Full access to the account’s mailboxes, including permanent deletion of threads and messages This scope should only be requested if your application needs to immediately and permanently delete threads and messages, bypassing Trash; all other actions can be performed with less permissive scopes.	Restricted

The Usage column in the table above indicates the sensitivity of each scope, according to the following definitions:

• Recommended—These scopes provide the smallest scope of authorization access and do not require any app verification or security assessment.

• Sensitive—These scopes allow access to Google User Data and require a sensitive scope verification process. For information on this requirement, see Google API Services: User Data Policy. These scopes do not require a security assessment.

• Restricted—These scopes provide wide access to Google User Data and require you to go through a restricted scope verification process. For information on this requirement, see Google API Services: User Data Policy and Additional Requirements for Specific API Scopes. If you store restricted scope data on servers (or transmit), then you need to go through a security assessment.

If your app requires access to any other Google APIs, you can add those scopes as well. For more information about Google API scopes, see Using OAuth 2.0 to Access Google APIs.

OAuth verification

Using certain sensitive OAuth scopes may require that your app go through Google's OAuth verification process. Read the OAuth verification FAQ to determine when your app should go through verification and what type of verification is required. See also the Google API Services: User Data Policy.