How long does Google's OAuth review take for a calendar app?

Why a calendar app needs the review

Google classes calendar access as sensitive. Its own example: "Examples of sensitive scopes include reading events stored in Google Calendar." That covers the scopes a calendar feature needs, such as calendar, calendar.events and calendar.readonly.

Until Google verifies your app, it can only be used in one of two ways:

• Testing. Projects in testing "are limited to up to 100 test users listed in the OAuth consent screen", and "authorizations by a test user will expire seven days from the time of consent", refresh tokens included. Every tester reconnects once a week.
• In production, unverified. Anyone can try to sign in, but they see Google's unverified app warning first, and "unverified apps that are accessing restricted or sensitive scopes have a 100 new-user cap". The cap "applies over the entire lifetime of the project" and "cannot be reset or changed."

Neither works for a product with customers, so sooner or later you submit for verification.

What Google asks for

Sensitive scopes need everything in brand verification, plus:

1. Verified domains. You prove you own every domain in the consent screen's authorized domains, in Google Search Console.
2. A privacy policy linked from your homepage and from the consent screen, the same link in both, hosted on the homepage's domain.
3. A justification for each scope, including why a narrower scope would not do. If calendar.events covers what you ship, asking for calendar gets you sent back.
4. A demo video that "must show the end-to-end flow of your app including the OAuth grant process", with the consent screen and the exact scopes visible.

Restricted scopes, such as full Gmail or Drive access, add an annual security assessment by a Google-approved assessor. Calendar scopes do not need one.

How long it takes, according to Google

Google gives two numbers:

The FAQ adds that "these estimates are not guaranteed" and depend on how quickly you answer.

How long it takes in practice

Google's developer forum has a steady stream of 2026 threads from teams whose calendar reviews stalled:

• Under review for over 5 weeks, for calendar.events.
• Stuck for about 12 weeks.
• Data access verification stuck for about 3 months, with no email from Trust & Safety.

These are self-reported, so treat them as a pattern, not a statistic. The pattern is consistent, though: the first pass takes days, and most of the wait is in the passes after it. A reviewer asks for a change, you reply, and the app goes back in the queue.

Where reviews get sent back

The requests developers report most often:

• The demo video skips the consent screen, or doesn't show the scopes being used.
• A broader scope was requested than the features in the video need.
• The privacy policy doesn't say what the app does with Google user data, or isn't linked the same way from the homepage and the consent screen.
• The app name or logo on the consent screen doesn't match the homepage.

Then the same exercise starts again for Microsoft, where some organizations only let an administrator approve new apps for work accounts, and for Zoom's Marketplace review if you add Zoom links.

Getting through faster

1. Ask for the narrowest scope that covers what you ship today. You can add scopes later, with another review.
2. Record the video against your production OAuth client, in one take, and show every scope being used.
3. Make the privacy policy name Google user data explicitly, and link it identically from the homepage and the consent screen.
4. Answer reviewer emails the same day. Each reply puts you back in line.

Or skip it

If your users connect through a service whose Google app is already verified, the review is that service's work, not yours. That is how Pyas works on every plan, the free one included: your users approve Pyas on Google's own consent screen, and you call one API for Google Calendar, Outlook and Zoom. When you want your own name on the consent screen, you can switch Google to Native Auth, with your own OAuth client, and go through the review on your own schedule.

Common questions

Do calendar scopes need a security assessment (CASA)?

No. The annual assessment is for restricted scopes, such as full Gmail or Drive access. Calendar scopes are sensitive: they need the verification above, not the assessment.

Can I launch while the review is pending?

Only to 100 new users over the life of the project, and each of them sees the unverified app warning first.

Do apps used only inside my Google Workspace organization need it?

No. An app set to the Internal user type, used only by people in your own Workspace or Cloud Identity organization, skips verification. That stops being an option as soon as customers outside your organization sign in.