OAuth apps
App verification
Which scopes need a verified app, what review looks at, and how to submit.
Every OAuth app can ask for the everyday scopes: openid, profile, email,
offline_access, and the task, staff, job and generation APIs. Five scopes reach
into what a workspace has stored or spends heavily, so an app must be verified
before it may request them:
| Scope | Why it is gated |
|---|---|
files.read, files.write | Reads or writes the workspace’s drive |
brain.search | Searches the workspace’s private knowledge |
workflows.run | Runs prompts other people wrote, with their assignees |
videos.generate | The most expensive generation Dhanu offers |
An unverified app that lists one of these in scope gets oauth_client_unverified
at the authorize step, before anyone sees a consent screen.
Submitting
From Developers → OAuth apps, choose Submit for verification on the app. Tell us
in a few lines what the app does and why it needs each gated scope. Review checks
that the app is what it says (a real homepage, a privacy policy people can read),
that the redirect URIs belong to you, and that the scopes match the feature,
an app that syncs tasks does not need files.write. Expect an answer within a few
working days; a rejection says why, and you can submit again.
Verified apps show a Verified by Dhanu mark on the consent screen and on each person’s Connected apps page. Verification is per app, not per developer, and can be withdrawn if the app changes what it does.