Repository navigation
README: Google setup is per deployment, and needs no Google review for personal use - #13
Merged
Merged
Conversation
…r personal use The README and .env.example said every Gmail sign-in would expire after seven days "until the app passes Google's verification" (OP2-283), and the status table called that review a launch blocker. Both overstated it. - Google ties the seven-day refresh-token expiry to the "Testing" publishing status, not to being unverified. A client published to production for personal use keeps its sign-ins (until revoked or six months unused) and needs no review; users click through Google's unverified-app warning, with a 100-account cap. - Each self-hosted deployment brings its own Google OAuth client, so there is no shared Outpost app to approve. The full review (brand verification, demo video, annual CASA assessment) is for apps offered to the public, which the licence does not allow. New "Google setup" section: the four steps, and a table of the three consent-screen choices (production for personal use - recommended -, Testing, Internal for a Workspace organisation) with who can connect, how long a sign-in lasts and what review applies. The status row and the .env.example comment now say the same; two code comments that cited OP2-283 as a pending blocker no longer do. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V7aurkG6ivoSJf2yFGtzi8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Corrects the Gmail setup docs. The README overstated Google's app review, and OP2-283 described it as a launch blocker. It isn't one, for two reasons.
The full review (domain and brand verification, a demo video, and an annual independent CASA security assessment) is only for an app offered to the public, which the licence doesn't allow anyway.
Changes
New README section, "Google setup": the four setup steps, plus a table of the three consent-screen choices:
It also notes that Outpost's own GitHub allowlist is the real gate, so publishing to production doesn't open Gmail to anyone else, and that the Cloud Console may still show "needs verification" (fine for personal use).
Status table: "blocked on Google's app verification (OP2-283)" becomes "per-deployment Google client; no Google review needed for personal or internal use".
.env.example: now recommends publishing to production and explains Testing's seven-day expiry.Two code comments no longer cite OP2-283 as a pending blocker. No behaviour changes.
Sources: Google's When is verification not needed, Restricted scope verification and refresh token expiration.
Generated by Claude Code