"Application Blocked" despite not needing verification

[Hatchet]

I have a very small project that only needs to work for one user. It simply runs a cloud function at an interval and performs some simple operations on their account using a refresh token. I made a similar project for myself that works just fine. However, this time, when I put this project in production mode, the person is unable to log in, receiving an "Application Blocked" message. I already applied for verification, and was rejected, reason given: "your app is for internal use." However, the account by whom the application is intended to be used is unable to even authenticate with the app.

I cannot leave the app in testing mode because then the refresh tokens expire after 7 days.

[marcanthonyb]

Hi @Hatchet ,

We would need more details to identify the issue. What language are you using? Could you also provide the full output log for that specific invocation for us to look further. In the meantime, have you already checked out this article?

Regards,
Marc

[Hatchet]

Yes, I already checked the article before posting.

I am using JavaScript/TypeScript on Firebase. There are no logs to speak of, because the problem occurs before the user is even authenticated (since it's a single-user application, I didn't build a login flow and am simply using https://developers.google.com/oauthplayground/ )

[imtaher]

It sounds like you are facing some issues with your app when trying to use it in production mode. Based on the information provided, it seems that your app is being blocked by the platform's security measures, possibly because it has not been verified yet.

Since you have already applied for verification and were rejected, it might be worth considering other options for authentication and authorization, such as OAuth 2.0 or OpenID Connect. These standards are widely used in the industry and can provide a secure and reliable way to authenticate users and grant access to your application.

Regarding the issue with the refresh tokens expiring after 7 days, you could consider implementing a mechanism to automatically refresh them before they expire. For example, you could use a background task or a cron job to periodically refresh the tokens, ensuring that the user can continue to use the app without interruptions.

Overall, it might be helpful to review the platform's guidelines and best practices for developing and deploying applications, and seek advice from experienced developers or a support team if needed.

[Hatchet]

I don't think you can refresh refresh tokens... then you would have a refresh token refresh token. I don't have other users to authenticate, and I need access to some of the Google APIs available on GCP.

I tested logging in with multiple accounts I control, and then the user with multiple accounts he controls. All of them work fine except the particular account that needs to be authenticated receives the "Application Blocked" message.

[imtaher]

You are correct, you cannot refresh refresh tokens. My apologies for the confusion. In this case, if you don't have other users to authenticate and you need access to specific Google APIs available on GCP, you might want to look into using service accounts. Service accounts are a special type of account that allows your application to make authorized API calls on behalf of your project or organization, rather than a specific user.

As for the issue with the "Application Blocked" message, it's possible that the account in question is subject to additional security restrictions or has a different configuration that is causing the block. It might be helpful to reach out to the support team for the platform or Google Cloud Platform to get more information and assistance in resolving the issue. They may be able to provide more specific guidance based on the details of your application and the platform's security measures.