How we passed Google’s GBP API audit in 35 days on the first try (zero legal budget, 100% solo)

Passing the Google Business Profile (GBP) API audit for a B2B SaaS is notorious for being a nightmare. Most startups spend months in email back-and-forths or drop thousands on compliance agencies just to get off quota 0. As a solodev building LocalPatron at night while running a physical burger shop (La Casa de Burger in Spain) by day, I didn’t have a legal team or a budget to burn. We got fully approved on the allowlist in 35 days on our very first attempt. If you are building a B2B SaaS that relies on strict third-party APIs (Google, Meta, LinkedIn), here are the 3 non-obvious rules that got us through:1. Live Production Proof Beats Static Docs
Auditors deal with hundreds of low-effort or fake app submissions daily. When our auditor demanded a SaaS domain older than 60 days or changing my restaurant's live URL, I refused—doing so would trigger automated spam bots and risk my physical business. Instead, I renamed our GCP project to "LocalPatron by La Casa de Burger" and live-edited the HTML footer of my restaurant’s website to display "Powered by localpatron.app". Showing a real, operating business using the integration in real-time cleared all doubts instantly. 2. The 3-Second UI Hover Trick
Google requires absolute proof that the client_id in your OAuth consent flow matches your console. Browsers naturally cut off long URLs. In our 2m30s OBS recording, I held the mouse static over the address bar for 3 seconds—triggering the native OS tooltip to reveal the untruncated parameter without breaking the video flow. That single detail avoided an instant rejection. 3. Optimize Architecture for Audit Stress Tests
We built on a $0 Edge stack (Next.js + Cloudflare Workers / D1). When the auditor tested performance, our sub-0.9s LCP and 0ms TBT proved the app was stable, production-ready, and incapable of abusing API rate limits. Building software to solve your own operational headaches gives you a massive advantage. You don't build bloat for pitch decks; you build tight, compliant tools that work. I recorded the full 2m30s OBS audit sequence (including the footer live-edit and tooltip trick) as an unlisted video.If you're currently stuck in Google API audit hell or preparing your SaaS OAuth consent review, drop a comment below and I'll send you the unlisted link directly!