“Script has not been verified” (OAuth Warning)

The “Script has not been verified” (or “Google hasn’t verified this app”) warning appears when a Google Apps Script requests access to user data, such as Google Sheets, Drive, or Gmail, without having completed Google’s official OAuth verification process. For self-authored or internal organization scripts, this warning is standard security behavior and completely safe to bypass by clicking Advanced and selecting Go to [Script Name] (unsafe). For published tools distributed to external users, resolving the warning requires configuring an OAuth consent screen in Google Cloud Console or restricting the script’s requested permissions.

Fast-Fix: The 45-Second Solution

The “Script has not been verified” screen is an intent-intercept warning triggered when an unverified Google Cloud project requests OAuth permissions. To proceed immediately, click the small Advanced link at the bottom left of the warning popup, scroll down, and select Go to [Script Name] (unsafe). Review the requested access scopes on the OAuth permission screen and click Allow. For internal enterprise apps, configure the OAuth consent screen publishing status to Internal in the Google Cloud Console to bypass external verification entirely.

Quick Risk Snapshot

• Severity: Low to Moderate (Blocks initial script execution until authorization is granted)
• Safe to Run?: Yes for personal or internal company scripts; No for untrusted third-party code
• Primary Cause: Unverified Google Apps Script requesting sensitive or restricted OAuth scopes
• Secondary Cause: Script code updated to include new Google API services (e.g., adding GmailApp or DriveApp)
• Rare Cause: Custom Google Cloud Platform (GCP) project linked to the script lacking an approved OAuth consent screen

Low Risk vs. High Risk Diagnostic Paths

Determining whether the unverified warning represents a routine administrative step or a security threat depends on who created the underlying script:

• Personal or In-House Script (Low Risk): If you or a teammate wrote the Google Apps Script bound to your spreadsheet, the warning is purely procedural. Google flags all unverified projects by default. Clicking through the Advanced menu authorizes your own code to run against your account data safely.
• Untrusted Third-Party Script or Template (High Risk): If you downloaded a public spreadsheet template or received a shared file from an external source, bypassing the warning grants that script access to your personal or corporate Drive files, Gmail, or contacts. Inspect the source code in the Apps Script editor (Extensions > Apps Script) before granting authorization.

How Google OAuth Verification Works

Before an Apps Script function can read or write data outside the active cell grid, Google’s authorization engine performs an OAuth handshake to verify what permissions the script is asking for and who owns the script project.

Think of Google’s OAuth system like a security checkpoint at a high-security facility. When a script calls a service like SpreadsheetApp.getActiveSpreadsheet() or MailApp.sendEmail(), it presents a access request badge (an OAuth scope request).

If the script project is owned by an individual @gmail.com account or has not been submitted to Google’s Trust & Safety team for formal review, the security guard flags the project as “unverified.” Google halts execution and displays the full-screen OAuth warning. This ensures users are explicitly aware when third-party code attempts to access their cloud account resources.

Probability Breakdown: Root Causes of Unverified Warnings

Root Cause	Likelihood	Key Identifier
First-Time Execution of Personal Script	65%	Standard warning shown when running custom Apps Script for the first time under a consumer or unconfigured project.
Shared Template Across External Domains	20%	Script created in one domain or @gmail.com account is opened and executed by a user in another domain.
Addition of Sensitive OAuth Scopes	10%	Editing script code to add calls to GmailApp, DriveApp, or external APIs triggers a new authorization prompt.
Unconfigured GCP Project Linking	5%	Script project manually linked to a Google Cloud Platform project that lacks a configured OAuth consent screen.

What Increases the Risk

• Requesting Restricted Scopes: Including services like GmailApp (sending/reading email) or broad DriveApp access triggers stricter security screens than basic SpreadsheetApp access.
• Distributing Scripts to Consumer Accounts: Sharing container-bound scripts across standard @gmail.com accounts forces every user to encounter the unverified screen, as individual accounts cannot publish “Internal” trusted apps.
• Modifying Script Code Post-Authorization: Adding a single line of code that references a new Google service invalidates prior user consent and forces the OAuth warning screen to reappear on the next execution.

Consequence Timeline: Operational Friction Impact

• 0 Minutes (Immediate Block): The script execution halts instantly. Custom menus, sidebar controls, and manual button triggers fail to execute.
• 1 Hour: Automated time-driven or form-submit triggers fail silently if the script owner modified code without completing the re-authorization flow.
• 1 Week: External users or team members abandon the spreadsheet tool, assuming the security warning indicates a virus or broken software.

What This Is Confused With (Error Signal Breakdown)

Warning / Error Code	Cause / Mechanism	Key Difference from “Script not verified”
“Script has not been verified”	OAuth Consent Security Screen: Unverified project requesting access to account scopes.	Full-screen Google warning modal with an “Advanced” dropdown link.
“Authorization required”	Standard Consent Prompt: Google requesting routine permission to run a script for the first time.	Standard prompt that appears before or alongside the unverified warning screen. See Resolving “Authorization required” Loops (Triggers).
“Script does not have permission for that service”	Manifest Scope Restriction: The script’s appsscript.json manifest is missing required oauthScopes.	In-editor execution error thrown when running code, rather than a web UI authorization screen. See “Script does not have permission for that service”.
“Action not allowed”	Contextual Permission Mismatch: Simple trigger trying to perform restricted actions like sending email.	Execution error caused by trigger security boundaries rather than OAuth verification status. See “Action not allowed” (Permissions Mismatch).
“401 Unauthorized”	External API Failure: Calling an external REST service with invalid or expired API keys.	Network HTTP error response when making UrlFetchApp requests. See “401 Unauthorized” (Calling External APIs).

What To Do Right Now

Option 1: Bypassing the Warning (For Personal / Known Scripts)

1. Trigger the script action in Google Sheets.
2. When the Authorization required popup appears, click Continue.
3. Select your Google account.
4. On the “Google hasn’t verified this app” screen, click Advanced in the lower-left corner.
5. Click Go to [Script Name] (unsafe).
6. Review the permissions list and click Allow.

Option 2: Eliminating the Warning for Workspace Teams (For Developers)

If you are developing scripts for colleagues within a Google Workspace organization:

1. Open the Google Cloud Console (console.cloud.google.com) associated with your project.
2. Navigate to APIs & Services > OAuth consent screen.
3. Set the User Type to Internal.
4. Save the configuration. All users within your Workspace domain will now bypass the “unverified app” warning entirely when authorizing the script.

Option 3: Restricting Requested Scopes

To prevent terrifying users with broad permission requests, explicitly define narrow OAuth scopes in your script manifest:

1. In the Apps Script editor, open Project Settings (gear icon) and check Show “appsscript.json” manifest file in editor.
2. Open appsscript.json and add an explicit oauthScopes array containing only the minimum necessary permissions (e.g., https://www.googleapis.com/auth/spreadsheets.currentonly).
3. For step-by-step manifest editing instructions, see How to manually add oauthScopes to your Manifest and “Script requires the [Specific Scope] permission”.

Hard-Stop Triggers: When NOT to Bypass the Warning

• Unknown Source Code: Never bypass the warning if you downloaded a public file or add-on from an unverified source and cannot read the underlying Apps Script code.
• Excessive Permission Requests: If a simple formatting script asks for full access to read, delete, or send emails from your Gmail account (https://mail.google.com/), stop immediately and inspect the source code for malicious data exfiltration routines.

What an Admin Will Check

When auditing unauthorized or unverified script warnings across a company network, a Google Workspace Administrator will:

1. Review Workspace OAuth Controls: Check Security > Access and data control > API controls in the Google Admin Console to verify whether user-installed apps and unverified scripts are blocked domain-wide.
2. Inspect App Owner Domain: Confirm whether the script project is owned by an internal corporate account or an external personal account.
3. Verify GCP OAuth Consent Screen Status: Ensure internal company scripts are linked to a managed GCP project configured with an Internal publishing status.
4. Audit Scope Access: Use domain auditing tools to verify which users have granted external unverified scripts access to corporate Drive or Gmail resources.

Typical Effort Range

• Bypassing Warning for Personal Use: 15 to 30 seconds.
• Configuring Internal Workspace OAuth Consent: 10 to 15 minutes in Google Cloud Console.
• Full Google Verification for Public Add-Ons: 2 to 6 weeks (requires domain verification, privacy policy submission, and security assessments).

Related System Escalators

• To troubleshoot persistent authorization prompts that keep reappearing on every execution, see Resolving “Authorization required” Loops (Triggers).
• To learn how to bypass verification screens safely across different script setups, see How to bypass “Script not verified by Google” Warning.
• If your script fails with permission errors after authorization, see “Action not allowed” (Permissions Mismatch).
• To configure explicit scope limits in your project manifest, read How to manually add oauthScopes to your Manifest.

Workspace Assessment

The “Script has not been verified” warning is an intentional security gate designed to stop untrusted code from silently accessing your Google account. For personal and internal organizational scripts, clicking through Advanced > Go to [Script Name] (unsafe) is standard operating procedure. For enterprise deployments, setting your Google Cloud OAuth consent screen to Internal eliminates the warning completely across your domain, ensuring a smooth and professional workflow for all users.