OAuth app approval guides
Each guide shows the work, wait time, and review needed to get an app's OAuth app approved.
Verified guides
- GitHubVerifiedTier 2 · Self-serve, optional reviewGitHub does not review your app. Any user can install a public GitHub App. The deciding factor is the customer: an org owner must install it for org repos.
- Google (Gmail + Calendar)VerifiedTier 4 · Review + external auditReading mail (gmail.readonly, gmail.modify) and creating drafts (gmail.compose) are restricted scopes. They need Google verification plus a yearly CASA security assessment. No Calendar scope is restricted.
- LinkedInVerifiedTier 3 · Review requiredSign-in and posting are self-serve. Reading analytics, Pages, or comments needs Community Management API vetting: two reviews, legal organizations only. Reading a member's own posts, feed, or messages is closed to everyone.
- Meta (Facebook, Instagram, WhatsApp)VerifiedTier 3 · Review requiredUsers without an app role can grant a permission only after it gets Advanced Access. That needs App Review per permission plus Business Verification. Plan for 1 to 8 weeks of waiting.
- Microsoft (Outlook and Calendar via Graph)VerifiedTier 3 · Review requiredThe customer's tenant consent policy decides this. The default policy blocks user consent to mail and calendar read, so an admin must approve. Microsoft does not review the app, but other tenants cannot consent beyond sign-in until you pass publisher verification.
- SalesforceVerifiedTier 2 · Self-serve, optional reviewSalesforce does not approve your app. Each customer admin must install your managed package. Security review is only for AgentExchange, Group or Professional orgs without the API add-on, or removing the install notice.
- SlackVerifiedTier 2 · Self-serve, optional reviewAny workspace can install your app without review. The deciding factor is the read limit: unlisted apps read history once a minute, 15 messages per call. Production needs a Marketplace listing.
Tiers
The tier reflects what you wait on.
- Tier 1 · Self-serveAny user can connect after you register. No review.
- Tier 2 · Self-serve, optional reviewAny user can connect. Review applies only to a public listing or higher limits.
- Tier 3 · Review requiredThe provider must approve the app before users outside your test list can connect.
- Tier 4 · Review + external auditReview plus a third-party security assessment. Often paid and yearly.
- Tier 5 · GatedRequires a partner application, paid plan, or business approval. The provider can refuse.
Customer-side gate: your users' admins may need to approve the app. See About for how guides are made.