LinkedIn
Instagram
WhatsApp
Telegram
Gmail
Outlook
Google Calendar
Join Slack CommunityGoogle OAuth 100 User Limit: How to Scale Past the Cap (2026)
Your app hit the Google OAuth 100 test user limit. Authorization fails, users are locked out, and the 7-day expiration trap makes it worse. Here are the 3 paths to unlimited users - ranked by speed and cost.
What Is the Google OAuth 100 User Limit?
If your app is in Testing publishing status on the OAuth consent screen, Google hard-limits you to exactly 100 test users. Once that count is reached, any new user attempting to authorize your app receives an error. This is the Google OAuth 100 user limit - and it catches most developers by surprise mid-launch.
The Google OAuth 100 user limit (also called the "OAuth user cap") restricts apps in Testing mode to a maximum of 100 authorized users. It applies regardless of how many test user emails you add to the Google Cloud Console. When the cap is hit, new users cannot complete the OAuth flow - authorization fails immediately.
The cap prevents unreviewed apps from accessing sensitive user data at scale. It forces developers to go through the verification process before reaching production-level usage.
In Testing status: hard 100-user cap. In Production status: cap is removed for approved scopes only. Unapproved sensitive scopes remain capped even in production.
Google Cloud Console - APIs & Services - OAuth consent screen - Audience tab. The "Test users" section shows how many of the 100 slots are used.
Where does the google oauth 100 user limit appear in the Console?
Navigate to APIs & Services in the left menu, then click OAuth consent screen.
If your app shows Testing under "Publishing status", the google oauth user cap is active. You're limited to 100 authorized users maximum.
Click Audience (previously called "Test users"). Here you see your added test user emails and the running total against the 100-user limit.
When the cap is reached, users see: "OAuth user cap reached" or "access_denied: this app hasn't been verified". Both confirm the google 100 user limit oauth cap is in effect.
Why You're Hitting the Cap (Even After Verification)
The google oauth user cap isn't always caused by being in Testing mode. There are 4 distinct scenarios that trigger the cap - and knowing which one applies to you determines the correct fix. Many developers are surprised to discover the cap persists even after completing verification.
Your app is in Testing publishing status. This is the most common cause of the google oauth 100 user limit. No matter how many emails you add to the test user list, the authorization count is capped at 100. The fix: move to Production via app verification.
Most CommonCritical insight: Even if your app is in Production, using sensitive scopes (like Gmail read/send, Calendar, Drive) that were never verified re-applies the oauth user cap. The cap is scope-specific, not just status-specific. This is why some verified apps still hit the google oauth user cap.
Often OverlookedYou've submitted your app for verification but Google hasn't approved it yet. The cap stays firmly in place until the review is complete. Sensitive scope reviews take weeks; restricted scopes requiring CASA Tier 2 assessment can take months. No workaround exists during this window.
Waiting GameYou were in Production with approved scopes, then added a new sensitive scope (e.g., adding Gmail access to an app that previously only used basic profile). The new scope triggers a re-review requirement, and the google oauth user cap re-applies for users authorizing the expanded scope set until the new scope is approved.
Expansion RiskSearching "user cap reached limit although verified" is a common developer frustration. The answer is almost always scenario 02: the app is verified but the specific scopes being requested were not part of the verified scope set. Google's cap is granular: it applies per unapproved scope, not per app. Check your exact scope list against your verification approval letter.
Skip all 4 scenarios entirely. Unipile's pre-verified credentials mean your users never hit the google oauth 100 user limit - regardless of which scopes you need.
Build Without the CapThe Hidden 7-Day Expiration Trap
There's a second problem that makes the google oauth 100 user limit even worse for SaaS products. Even if your 100 slots aren't full, the authorizations granted by test users automatically expire after 7 days. This means your users must re-consent every week - completely breaking any production workflow.
Google's documentation buries this: refresh tokens for apps in Testing mode are automatically invalidated after 7 days. Your user granted access on Monday? By the following Monday, your app is unauthorized. Your token refresh call returns invalid_grant. The user must go back through the consent screen and re-authorize. For any app handling email sync, this is a complete showstopper.
User completes OAuth flow. Access token + refresh token granted. App works perfectly.
App refreshes access token using refresh token. No user action needed. Appears stable.
Token refresh still works. Tomorrow everything breaks. No warning to the user or developer.
Token refresh fails with invalid_grant. User is effectively logged out. Must re-consent.
Apps syncing Gmail or Outlook lose access after 7 days. Historical sync may trigger again from scratch, causing duplicate data and confused users.
There's no email or notification to the user. The app just starts failing API calls. Users discover the problem when a feature stops working, not before.
Users are redirected back to Google's consent screen weekly. This destroys retention. Most users won't re-authorize. Churn directly caused by the google oauth test users limit.
Bottom line: Adding test users to your google oauth 100 user limit is a temporary workaround, not a solution. The 7-day expiration makes it impossible to run any real production workload on Testing mode credentials. The three valid solutions are: complete Google verification, switch to non-sensitive scopes, or use a provider with pre-verified credentials. We cover all three in detail below.
How to Add Test Users to Google OAuth
Before reaching for a permanent fix, you may need to add test users to google oauth to unblock specific people during development. Here's the exact process - plus the critical caveats that mean this is never a real solution for production apps.
Go to console.cloud.google.com and select the project your OAuth credentials belong to. Make sure you're in the correct project - the one where your OAuth 2.0 Client ID was created.
In the left sidebar: APIs & Services then click OAuth consent screen. If you don't see this option, ensure the Google+ API or the correct API is enabled in your project.
In the OAuth consent screen settings, find the Audience tab (previously labeled "Test users" in older Console versions). This is where the google oauth 100 user limit is managed. You'll see your current publishing status and the test user count.
See also: Complete guide to the Google OAuth consent screen setup
Under the "Test users" section, click the + ADD USERS button. A dialog appears where you can enter email addresses. You must use exact Google account emails (gmail.com or Google Workspace accounts).
Enter one or more email addresses (you can paste a list). Click Add, then Save. The users are now authorized to complete your OAuth flow even while the app is in Testing status. They will see the "unverified app" warning screen but can proceed.
Complete Google Verification - The Official Path
The canonical way to increase google oauth user limit is to complete the verification process. When approved, the 100-user cap is removed for your verified scopes, and authorizations no longer expire after 7 days. This is the right path if you need your own Google credentials long-term - but it's not fast.
Fill out the OAuth consent screen completely. Write a clear homepage URL, privacy policy, and terms of service. Describe exactly which scopes your app needs and why each is required. Incomplete forms are the #1 reason for rejection.
Click "Publish App" in the OAuth consent screen to trigger verification. Google will email you with next steps. For basic scopes (email, profile), review is automated. For sensitive scopes (Gmail, Calendar, Drive), a manual review begins.
For scopes like gmail.readonly, calendar.events, or Drive scopes, Google's team manually evaluates your app. Expect back-and-forth emails, demo videos, and justification documents. This can take 4-6 weeks.
For restricted scopes (Gmail send, full account access), you need a CASA Tier 2 security assessment. Google-approved assessors audit your app's security posture. Self-serve via Tier 2 app defense is free but time-intensive. Third-party assessors cost $15k-$75k USD.
| Scope Type | Examples | Review Time | Cost | Cap Removed? |
|---|---|---|---|---|
| Non-sensitive | email, profile, openid | Automated (instant) | Free | Yes (Production) |
| Sensitive | Gmail readonly, Calendar read | 4-6 weeks (manual) | Free | Yes (if approved) |
| Restricted | Gmail full access, send | 2-6 months (CASA Tier 2) | $0-$75k | Yes (if approved) |
Restrict to Non-Sensitive Scopes - The Workaround
Some apps can remove the google oauth 100 user limit without going through verification by restricting their scope requests to non-sensitive scopes only. This is the fastest path to unlimited users - but it comes at the cost of not being able to read or write Gmail, Calendar, or Drive data.
| Scope | Data Accessed | Sensitivity | Verification? | Cap Applied? |
|---|---|---|---|---|
| openid | User identity | Non-sensitive | Not required | No cap |
| Email address only | Non-sensitive | Not required | No cap | |
| profile | Name, photo | Non-sensitive | Not required | No cap |
| gmail.readonly | Read all email content | Sensitive | Required | Cap applies |
| gmail.send | Send email as user | Restricted | CASA Tier 2 | Cap applies |
| gmail.modify | Read/write all email | Restricted | CASA Tier 2 | Cap applies |
| calendar.events | Read/write calendar events | Sensitive | Required | Cap applies |
If your app only needs to identify the user (SSO, "Login with Google"), using openid email profile gives you unlimited users with zero verification. Perfect for authentication flows where you don't need to access email content.
If your product reads or sends Gmail messages, syncs calendar events, or accesses Drive files, there's no escape from sensitive scopes. Non-sensitive scope limitation is not a viable option for email sync, CRM enrichment, or calendar scheduling apps.
gmail.readonly, which is a sensitive scope requiring verification. See the complete Gmail API scopes guide for the full breakdown of which scopes require which level of approval. If you need email access without waiting for verification, Option 3 (below) is your only real alternative.
Use a Pre-Verified OAuth Provider - The Shortcut
The fastest way to remove the google oauth 100 user limit entirely is to use a provider that has already completed Google's verification and CASA Tier 2 assessment with their own credentials. Instead of waiting weeks or months, your users can authorize immediately with no cap, no 7-day expiration, and full access to Gmail and Calendar APIs from day one.
The managed provider uses their own pre-verified Google credentials. Their verification covers all Gmail and Calendar scopes. Your users authorize against credentials that have no 100-user cap and never did.
Production-verified credentials issue refresh tokens with standard expiration (months, not days). Users never need to re-consent weekly. Gmail sync runs continuously without interruption.
Once your own verification completes, migrate to your own Google credentials with zero downtime. No re-authentication required for your users. Zero migration cost.
How to connect Gmail accounts with Unipile (no cap, no wait)
Sign up at dashboard.unipile.com/signup and get your API key. Takes under 2 minutes. No credit card required for the trial.
Call POST /v1/accounts with "provider": "GOOGLE_OAUTH" and "use_unipile_credentials": true. Unipile handles the OAuth flow with its CASA Tier 2 certified credentials. No 100-user limit. See the Unipile Google OAuth docs for the full API reference.
Once the account is linked, call GET /v1/emails to read messages or POST /v1/emails to send. You have full Gmail access from the first API call. Explore the Email API guide for all available endpoints.
When your Google verification completes (weeks or months later), update the account linking to use your own OAuth credentials. Existing linked accounts continue to work. Your users never notice the transition. See the complete Google OAuth integration guide for the credential migration steps.
Weeks of verification.
Use Unipile's key and start now.
Don't lose customers waiting on Google's review. Connect Gmail accounts in 5 minutes with our pre-verified developer credentials. No google oauth 100 user limit, ever.
3 Ways to Scale Past the Google OAuth User Cap
Here's an honest comparison of all three paths to remove the google oauth 100 user limit. Choose based on your timeline, budget, and whether you need Gmail or Calendar access.
| Feature | Option 1: Google Verification | Option 2: Non-Sensitive Scopes | Option 3: Managed Provider (Unipile) |
|---|---|---|---|
| Time to unlimited users | 4 weeks to 6 months | Instant | Under 5 minutes |
| Cost | $0 to $75,000 (CASA assessment) | Free | Subscription-based |
| Gmail/Calendar access | Full access (if approved) | No, basic auth only | Full access immediately |
| 7-day expiration issue | Resolved after approval | Not applicable | No expiration, ever |
| Developer effort | Very high (docs, reviews, CASA) | None (just restrict scopes) | One API call |
| Own credentials | Yes | Yes | Initially shared, switch later |
| Best for | Apps requiring full ownership of OAuth flow long-term | Auth-only apps that don't need email/calendar content | SaaS products that need Gmail access from day one |
If you're building a long-term product and need full ownership of the OAuth flow, verification is the right end goal, but plan for the timeline.
If your app only needs to identify users (not read their email), non-sensitive scopes completely bypass the cap with zero work.
If you need Gmail or Calendar access and can't wait months, Unipile's pre-verified credentials remove the google oauth user cap immediately.
Common Cap-Related Errors and Fixes
The google oauth 100 user limit surfaces in several different error messages depending on where in the flow the cap is hit. Here are the 4 most common errors - with the exact cause and fix for each.
The hard cap of 100 authorized users has been hit. Seen by users trying to authorize your app when it's in Testing mode and 100 users have already completed the OAuth flow.
Your app is in Production but you're still seeing cap-related errors. This happens when you request scopes not included in your original verification approval. The cap applies scope-by-scope.
A user is trying to authorize but gets an access denied error even though the cap isn't fully reached. Usually the user's email isn't in the Test users list, or you've exceeded the 100 test user count.
Your app was working, and now token refreshes are failing with invalid_grant. This is the 7-day expiration trap for Testing mode apps. The refresh token was revoked automatically by Google after 7 days.
invalid_grant and redirects the user.Google OAuth 100 User Limit - FAQ
Answers to the most common questions about the google oauth user cap, how to add test users to google oauth, and how to scale past the limit.
The Google OAuth 100 user limit is a restriction applied to apps in Testing publishing status on the OAuth consent screen. When your app is in Testing mode, a maximum of 100 users can authorize it. Once that count is reached, new users receive an access_denied error and cannot complete the OAuth flow. This google oauth user cap exists to prevent unreviewed apps from accessing sensitive user data at scale. See our complete Google OAuth guide for the full verification process.
To add test users to Google OAuth: 1) Go to Google Cloud Console. 2) Navigate to APIs & Services then OAuth consent screen. 3) Click the Audience tab. 4) Click Add Users. 5) Enter Google account emails and save. Note: the list max is 100 emails, and the google oauth 100 user limit tracks actual authorizations - not just listed emails. See the consent screen guide for full setup details.
Google automatically invalidates refresh tokens for apps in Testing mode after 7 days. This is a security measure to prevent long-lived access by unverified apps. After 7 days, token refresh calls return invalid_grant, and users must re-authorize. This makes Testing mode completely unsuitable for any production SaaS workflow that requires continuous access. Moving to Production via verification, or using pre-verified provider credentials, resolves this permanently.
Yes, you can increase google oauth user limit by completing Google's verification process and moving to Production status. Once approved, the 100-user cap is lifted for your verified scopes and tokens no longer expire weekly. Alternatively, using Unipile's pre-verified credentials gives you unlimited users immediately with no wait. The google oauth 100 user limit cannot be increased within Testing mode - 100 is an absolute hard cap.
The google oauth user cap is removed after verification for approved scopes only. If your app requests any scope that was not included in the original verification approval, the cap re-applies for those unapproved scopes. This is why some developers see "oauth user cap reached" even after verification - they added a new scope (like a Calendar scope to an app initially verified for Gmail only) without getting the new scope approved. Always match your OAuth request exactly to your approved scope list.
There are 3 ways to remove google oauth user cap: (1) Complete verification - submit your app for Google's review, get approved for Production status (4 weeks to 6 months). (2) Use non-sensitive scopes only - restrict to openid, email, profile (no Gmail/Calendar access, but no cap). (3) Use Unipile's pre-verified credentials - connect Gmail accounts immediately with our CASA Tier 2 certified keys. No cap, no 7-day expiration, full Gmail access from the first API call.
Non-sensitive scopes that require no verification and have no user cap: openid, email, profile. These give you identity information only. Any scope accessing Gmail content (gmail.readonly, gmail.send), Calendar (calendar.events), or Drive is sensitive or restricted and requires verification. See the Gmail API scopes guide for the complete scope sensitivity breakdown. For apps that need email content, there's no way around verification or using a pre-verified provider.
Google OAuth verification timeline depends on scope type: Non-sensitive scopes (email, profile) are auto-approved instantly when you publish the app. Sensitive scopes like Gmail readonly or Calendar events take 4-6 weeks for manual review by Google's team. Restricted scopes like gmail.send or full Gmail access require a CASA Tier 2 security assessment which takes 2-6 months and can cost $0 (self-serve) to $75,000 (third-party assessor). Plan accordingly and use interim credentials while verification runs.
No. The google oauth 100 user limit in testing mode is a hard, absolute cap - it cannot be increased within Testing mode by any means. Google does not offer any exception, upgrade, or workaround for this limit in Testing mode. The only way to exceed 100 authorized users is to move to Production status via verification, or to use pre-verified credentials from a provider like Unipile. There is no paid option or manual override to increase the cap in Testing mode.
The fastest way to connect unlimited Gmail accounts without the google oauth 100 user limit is to use Unipile's Gmail API. Unipile uses pre-verified, CASA Tier 2 certified Google credentials. You make one API call with use_unipile_credentials: true and users can authorize immediately. No 100-user cap, no 7-day token expiration, full Gmail read/send access from the first call. You can switch to your own verified Google credentials later without any user re-authentication. See the full API documentation to get started.
Still have questions about the google oauth 100 user limit? Our team is here to help.
EN 
FR 
ES 
DE 
IT 
BR 
NL 
PL 
TR