Is an unverified app warning a sign of malware?

Not by itself. It means Google has not completed its review of that app. It is a reason to check who publishes the app and what access it asks for, not proof of harm.

Why is there a limit of 100 users?

Google caps an unverified app at 100 new users over the life of the project, and the count does not reset. Nickbox's limited beta stays within that cap until verification finishes: it admits new people only while places remain.

What is the 7-day expiry in testing mode?

In Testing mode, test users' authorizations expire after 7 days, including refresh tokens for sensitive and restricted scopes. A user would have to reconnect weekly.

The Cloud Application Security Assessment, an annual security assessment by an approved lab that Google requires for apps using restricted scopes such as gmail.readonly. It takes roughly 4 to 8 weeks.

Why does Google say 'unverified app' for a Gmail MCP server?

Google shows "unverified app" when an app asks for access to Gmail and has not finished Google's verification. Nickbox has not finished Google's verification yet, so Google shows that warning and lets the app connect only 100 Gmail accounts, which is why the beta is limited.

What does the "Google hasn't verified this app" screen mean?

It means Google has not completed its review of the app's identity, privacy policy and use of your data. The screen appears before consent for apps that request sensitive or restricted permissions without verification. It asks you to check the publisher and the permission before you continue.

Before you click through, check three things: the app name and the developer's email on the screen, the exact permission requested, and whether you trust the publisher. For Nickbox, the permission is gmail.readonly, which can read mail and cannot send, delete or modify it. The security page lists what is stored.

Why does Gmail access trigger verification?

Gmail read access is a restricted scope, the strictest category Google has. Apps that use restricted scopes have to pass brand verification and an annual security assessment by an approved lab, called CASA (Cloud Application Security Assessment). Nango's guide to the process puts the assessment at about 4 to 8 weeks.

Google also requires a public homepage describing the app, a privacy policy that includes its Limited Use statement, terms of service, and a video of the OAuth flow, under its API Services User Data Policy. We have not published a cost for the assessment, because we do not have a confirmed figure.

What are the 100-user cap and the 7-day expiry?

There are two separate limits. An unverified app in production can add 100 new users over the life of the project, and the count does not reset (Google Cloud Help). In Testing mode, an app has up to 100 test users, and their authorizations expire after 7 days, refresh tokens included.

Mode	User limit	Authorization lifetime	Warning screen
Testing	Up to 100 test users	Expires after 7 days	Yes
Production, unverified	100 new users for the life of the project	Normal	Yes
Production, verified	Above 100	Normal	No

Apps in Testing status lose authorizations after 7 days, so testers reconnect every week. An unverified app published to production has a lifetime cap of 100 users and shows the warning. During the beta, Nickbox runs as an unverified app published to production, so you do not need to reconnect every week.

Why is the Nickbox beta limited?

Because of the 100-account cap. Nickbox has not finished Google's verification yet. Until it does, Nickbox admits new people only while it has places left, so the 100 slots are not used up at once. When they run out, a page says so and offers an optional interest list. Nickbox does not state a date for verification, because it depends on Google's review and the assessment.

If you join the beta, expect the warning screen when you connect your first inbox. What you are approving is the read-only permission. You can remove it any time at myaccount.google.com/permissions.

How can I check an app before I approve it?

Read the consent screen as a short contract. Confirm that the app name matches the product you meant to connect, that the developer contact is a real address, and that the permission list is as narrow as the product promises. A mail reader that asks to send or delete mail should make you stop.

Then look for a public homepage, a privacy policy and a clear statement of what the app stores. Google requires these for verification, so an app without them has more to explain. You can always say no, and you can remove access later.

What should I do if my Workspace blocks the app?

Workspace administrators can block unverified or untrusted apps entirely. If you see "This app is blocked" or "Error 400: admin_policy_enforced", your admin's policy causes it, not the warning. See how to allow an MCP app in Google Workspace for the steps and a note you can forward.

For setup in each assistant, use the guides for Claude, ChatGPT and Gemini. Pricing is on the pricing page: US$5 a month or US$48 a year, with a 7-day trial that needs a card.