Gmail OAuth scopes are the named permissions an app requests to use your Gmail data, such as gmail.readonly (view messages and settings) or gmail.send (send only). Google sorts scopes into non-sensitive, sensitive, and restricted. Most Gmail scopes, including gmail.readonly and gmail.modify, are restricted, which means an app serving the public must pass Google's verification and, if it handles the data on its own servers, an annual CASA security assessment. You can review and remove any app's access at myaccount.google.com/permissions.
What a Gmail scope is, in one paragraph
When an app asks to connect to your Google Account, it sends Google a list of scopes: strings like https://www.googleapis.com/auth/gmail.readonly, each granting one kind of access. Google's consent screen turns them into plain sentences. The general idea is covered in the OAuth scopes glossary entry. This guide is the Gmail-specific version: every scope, Google's own description, and the review each one triggers.
Google's three scope categories: non-sensitive, sensitive, restricted
Google grades every scope by how much user data it exposes. The grade decides how much review a developer has to pass before strangers can grant the scope. Apps that skip review show an "unverified app" screen and are capped at 100 new users in total.
| Category | What Google says it covers | What the developer has to do |
|---|---|---|
| Non-sensitive | Narrow access, such as managing labels or acting only inside an add-on you're using | No sensitive or restricted scope review |
| Sensitive | Access Google reviews before any account can grant it. Google's examples include reading Calendar events and storing a new contact | A written justification for each scope, an explanation of why a narrower scope won't work, a demo video of the consent flow, a verified domain, and a public privacy policy. Google says this typically takes 3 to 5 business days |
| Restricted | "Wide access to Google user data" | Everything required for sensitive scopes, proof the app is a permitted application type, and, for apps that access the data through their own servers, a CASA security assessment by a Google-approved assessor, repeated at least every 12 months |
Summarized from Google's sensitive and restricted scope verification pages. Exceptions apply for personal-use, testing, and internal Workspace apps.
Every Gmail API scope and what it allows
All Gmail scopes start with https://www.googleapis.com/auth/ except the full-access one, which is https://mail.google.com/. Descriptions below are Google's own wording.
| Scope | Google's description | Category |
|---|---|---|
gmail.labels | See and edit your email labels. | Non-sensitive |
gmail.addons.current.action.compose | Manage drafts and send emails when you interact with the add-on. | Non-sensitive |
gmail.addons.current.message.action | View your email messages when you interact with the add-on. | Non-sensitive |
gmail.addons.current.message.metadata | View your email message metadata when the add-on is running. | Sensitive |
gmail.addons.current.message.readonly | View your email messages when the add-on is running. | Sensitive |
gmail.send | Send email on your behalf. | Sensitive |
gmail.metadata | View your email message metadata such as labels and headers, but not the email body. | Restricted |
gmail.readonly | View your email messages and settings. | Restricted |
gmail.compose | Manage drafts and send emails. | Restricted |
gmail.insert | Add emails into your Gmail mailbox. | Restricted |
gmail.modify | Read, compose, and send emails from your Gmail account. | Restricted |
gmail.settings.basic | See, edit, create, or change your email settings and filters in Gmail. | Restricted |
gmail.settings.sharing | Manage your sensitive mail settings, including who can manage your mail. | Restricted |
https://mail.google.com/ | Read, compose, send, and permanently delete all your email from Gmail. | Restricted |
Two things stand out. First, gmail.send is only sensitive, which fits: an app that can send but not read never sees your existing mail. Second, gmail.metadata is restricted even though it excludes message bodies, because headers alone reveal who you talk to and when. The one scope to be wary of is https://mail.google.com/: it's the only Gmail scope that includes permanent deletion, and few apps that read and draft email need it.
What the CASA security assessment involves for restricted scopes
CASA stands for Cloud Application Security Assessment, the framework Google uses to standardize its reviews. If an app reads restricted Gmail or Drive data from or through a server it runs, a Google-approved third-party assessor has to evaluate it. The app must recertify at least every 12 months after the assessor's Letter of Assessment approval date.
Google lists four exceptions to verification: apps for personal use by you or a few people you know, apps in development with a limited set of test users, service accounts that only touch data the service owns, and apps used only inside one Google Workspace organization. In practice, a public app that asks for gmail.readonly without an unverified-app warning has been through Google's review. It doesn't tell you how the vendor behaves beyond what Google checks, which is why the vendor's own policies still matter.
Other Google scopes that often come with Gmail access
Email assistants rarely stop at Gmail. These are the Drive, Calendar, Contacts, and identity scopes you'll see alongside it.
| Scope | What it allows | Category |
|---|---|---|
drive.readonly | View and download all your Drive files. | Restricted |
drive.file | Create or modify only files you open with the app or share with it through a file picker. | Non-sensitive |
calendar | See, edit, share, and permanently delete all the calendars you can access using Google Calendar. | Not on Google's restricted list. Reading Calendar events is Google's own example of a sensitive scope |
contacts.readonly | Read the contacts saved in your Google Contacts. | Not on Google's restricted list |
contacts.other.readonly | Read your "other contacts", the people you've interacted with who aren't saved as contacts. | Not on Google's restricted list |
userinfo.email, userinfo.profile | See your email address and basic profile info. | Basic sign-in scopes |
Limited Use: the rules attached to Gmail data
Scopes decide what an app can reach. Google's API Services User Data Policy decides what the app may do with it. The Limited Use requirements say apps may use sensitive and restricted data only to provide or improve user-facing features that are prominent in the app. They can't sell or transfer it to ad platforms or data brokers, and staff may read it only with your agreement, for security investigations, for legal reasons, or in aggregated form.
Google's Workspace API policy adds an AI rule: developers may not use the data to create, train, or improve a machine-learning or AI model beyond that specific user's personalized model. If a vendor's privacy policy doesn't mention Limited Use, ask why.
How to see and revoke what apps can access your Gmail
- 1Open your Google Account connections
Go to myaccount.google.com/permissions while signed in to the account you want to check.
- 2Filter to apps with account access
Choose Access to your Google Account.
- 3Open an app and read its permissions
Select the app, then See details. Google lists what it can access, in the same language as the consent screen.
- 4Remove what you don't use
Select Remove access, then Confirm. The app loses access to your account right away. Data it already copied is governed by that vendor's retention policy, so check it or request deletion.
On a Google Workspace account, your admin may already decide this for you. In the Admin console under Security, Access and data control, API controls, admins can mark apps as trusted, limited, or blocked, and can restrict high-risk Gmail and Drive actions such as sending mail or deleting files.
The Google scopes Synced requests, and what each is used for
Synced, the AI inbox assistant, lists its Google scopes in its privacy policy and has completed Google's restricted-scope verification, including the CASA security assessment. Drive, Calendar, and Contacts scopes apply when you connect those services.
| Scope | Category | What Synced uses it for |
|---|---|---|
gmail.readonly | Restricted | Search messages, read message details and headers, and summarize threads |
gmail.modify | Restricted | Create drafts and send emails you've approved |
gmail.settings.basic | Restricted | Read and update your Gmail out-of-office auto-reply when you set it from Synced |
drive.readonly | Restricted | Search and read Drive files for context, like finding the file an email asks for |
calendar | Not restricted | Read availability and create or modify events |
contacts.readonly, contacts.other.readonly | Not restricted | Autocomplete invitees through the People API |
userinfo.email, userinfo.profile | Basic | Identify the connected account |
Google describes gmail.modify as "Read, compose, and send emails." Nothing in the scope itself requires your approval. Synced's rule that every AI-drafted message waits in Decide until you approve it is a product decision on top of the permission. Security details are on the Security page.
- Gmail API scopes (Google for Developers) (checked 2026-09-13)
- Sensitive scope verification (Google for Developers) (checked 2026-09-13)
- Restricted scope verification (Google for Developers) (checked 2026-09-13)
- Restricted scopes list (Google Cloud Help) (checked 2026-09-13)
- Unverified apps (Google Cloud Help) (checked 2026-09-13)
- Drive API scopes (Google for Developers) (checked 2026-09-13)
- Calendar API scopes (Google for Developers) (checked 2026-09-13)
- People API otherContacts.search (Google for Developers) (checked 2026-09-13)
- Google API Services User Data Policy (checked 2026-09-13)
- Google Workspace API User Data and Developer Policy (checked 2026-09-13)
- Manage links between your Google Account and apps (Google Account Help) (checked 2026-09-13)
- Control which apps access Google Workspace data (Admin Help) (checked 2026-09-13)