How to avoid Gmail’s API Security Audit?
As many of you know, Google has started a $15k+ security audit fee for developers who use Gmail APIs with restricted scopes: https://www.indiehackers.com/forum/psa-new-google-policy-creates-15k-barrier-to-entry-for-apps-using-the-gmail-api-08070e6e4c
Quick question for those who have built add ons or extensions for Gmail. Are the temporary Gmail Add on scopes offered to read and compose for Google Workplace Addons (https://developers.google.com/workspace/add-ons/concepts/gsuite-scopes#gmail_add-on_scopes) able to be used without undergoing the paid security audit?
If your Gmail addon needs to access just the email it's opened on you don't need the restricted Gmail scope and don't have to be verified.
But if you really want that offline email access then you have these two options, for G-Suite users (with a domain):
Ask your users to whitelist your clientId:
https://helpdocs.yoxel.com/pebbles/adding-pebbles-to-the-google-workspace-allowlist
Ask them to generate a service account key. Your code needs to be able to use the service account:
https://docs.aurinko.io/authentication/setting-up-g-suite-service-account