Google OAuth Verification Timeline: How Long It Really Takes in 2026
You submitted your app for verification and now the OAuth consent screen just says 'in review'. Days pass, a launch date looms, and nothing moves. The hard part is that 'Google verification' is not one queue with one waiting time — it is three separate reviews, each with its own clock, and the slowest can run for weeks while the fastest clears in a couple of days. Here is what the timeline actually looks like, what Google officially publishes, and the quiet mistakes that keep an app stuck far longer than the review itself.
The three verification tracks and their real timelines
Which track your app lands in depends entirely on the scopes it requests. That single factor decides whether you wait days or weeks.
Brand verification
Reviews your app name, logo, homepage, support email and authorized domains on the consent screen. Runs first whenever your branding has changed since the last approved review.
Sensitive scopes
Applies when your app reads or writes user data through a sensitive scope. Brand verification can be folded in as a subset of this request.
Restricted scopes
The heaviest track — broad Gmail, Drive and similar scopes. Google states it 'can potentially take several weeks', and deeper cases 'might require several months'. A CASA security assessment is usually part of it.
The first two figures are Google's own published estimates. For restricted scopes Google deliberately does not commit to a number — which is exactly why teams that request a restricted scope without planning for it get caught out.
The clock only starts when you decide to go public
A point most people miss: verification is only required to publish your app to the general public. Until then you can sit in Testing indefinitely — but with real limits.
- Testing status. Your app works, but only users you add to the test allowlist can use it, capped at 100 test users. Basic identity scopes (openid, email, profile) are exempt from that allowlist.
- Extra Testing limits. While in Testing, refresh-token lifetime is also shortened — a detail that quietly breaks long-lived integrations before you have even submitted.
- Publishing to production. Moving to Published / External for the public is the step that triggers verification. This is when the 2–3 day, 3–5 day or several-week clock begins — not the day you built the app.
- Still capped until approved. Even after publishing, an unverified app requesting sensitive or restricted scopes hits a hard 100-user total cap and shows the 'unverified app' warning until the review clears.
What silently stalls a verification
Most of the lost time is not Google being slow — it is the review sitting paused while Google waits on something on your side. These are the causes Google itself documents:
- Homepage is not publicly accessible, or is not clearly relevant to the app. A Play Store listing or Facebook page is not accepted as your homepage.
- Privacy policy is not hosted on the same domain as your homepage, is not linked on the consent screen, or does not disclose how you use Google user data.
- Domain ownership is not verified in Google Search Console under a Project Owner or Editor account.
- The scopes in your app code do not match the scopes configured on the consent screen — this alone forces the unverified-app screen.
- No detailed per-scope justification, or requesting a broad scope where a narrower one would do.
- The demo video does not show each requested scope in use, the app name on the consent screen, and the OAuth client ID in the address bar.
- Branding on the consent screen does not match the app's real identity.
- The review is paused waiting for your reply and the developer or support email on file is stale — so you never see the follow-up.
Restricted scopes come back every year
If your app keeps restricted-scope access, the security assessment is not one-and-done. Google requires re-assessment at least every 12 months, timed from your prior letter of validation or assessment approval date. Miss that recertification window — often because the notification email went to an unmonitored inbox — and access can lapse. Note too that the old CASA self-scan route is now deprecated; the assessment runs through a Google-approved path.
Where teams actually lose the most time
The review durations above are rarely the real bottleneck. The weeks disappear in the resubmission loop — a homepage that is not quite right, a privacy policy on the wrong domain, a demo video that misses a scope, a justification that reads as vague. Each miss sends you back to the end of the queue. Getting the consent screen, hosted policy pages, domain verification, scope justifications and demo video correct on the first pass is what separates a two-week approval from a two-month one. That preparation and submission work — matching every requirement to how Google actually reviews it — is exactly what our Google OAuth verification support covers, alongside brand verification and the heavier restricted-scope CASA path.
This article is general, policy-aligned guidance based on Google's official documentation as of July 2026; verification steps and timelines can change and vary by app. No specific outcome or timeline can be guaranteed. It is not an official Google resource and implies no partnership with Google.