Developer Spotlight: Granular OAuth consent and publishing to the Workspace Marketplace

Key Takeaways

It is strenuous on purpose and that is that is a frustrating thing for everybody but it it is you know they are not our our Google trust and safety team. They uh they they're really good folks. They are not out to get anybody. They we we take user [music] data and privacy and security quite seriously. You two are well aware of I think probably our audience is well aware of as well. Um, so there are a lot of things that need to be confirmed. They can't just take folks word for it and and that that can lead to a lot of back and forth with with the team. Hi everyone. I'm Steve Basil from the Workspace developer relations team and I'm joined here with Dave Dave Above and Joe Romeo. Uh yesterday we just had our workspace developer summit here in Sunnyvale and both of you did uh talks. Um so uh Dave I just want to start with you. Um could you uh give a little bit about what you talked about uh >> just for those who couldn't attend. >> Uh we talked about uh how to prepare your add-on or app for the specifically add-ons and written in Appcript and alternative runtimes for the upcoming change uh with granular OOTH permissions. Right? Up until now, when you approve your app, it's all or nothing. Uh with and in the for Appcript powered editor add-ons and Appcript powered uh workspace add-ons and HTTP alternative runtime add-ons. Now you're going to be able to have users select which permissions and scopes they want to use and we want to make sure app developers are prepared for that change. >> Okay. And yeah, I know I know we've been working on working towards, you know, more granular permissions for quite a while uh for web apps and Android apps and so on. Um so what what do developers need to know really like >> yeah um at the end of the day we want to give users more transparency and control but on the developer side you have to be prepared for the fact that users may come into your add-on and uh whereas up until now they could if they've granted permissions uh on the verific features of your add-on maybe for example your add-on does something in Gmail and Google calendar right it would just work but now a developer a user could come in and say well I I I want the add-on to work for Gmail but not for calendar because I don't want having access to my calendar. And in that case, uh if you're not handling that that situation, checking for those permissions, your add-on could fail in an unexpected way. >> Failing in an unexpected way sounds scary. [laughter] >> Yeah. >> Um is it a lot of work for developers to sort of, you know, adapt to this or, you know, at least sort of get back to how they were before? >> Uh absolutely not. And we talked about in the talk kind of three ways you could do this. The first is the do nothing method which I'm I'm I don't think we should we want to approach. Uh but the the main two methods are you can of course check what permissions the user has and then you have two choices. Um do you want to allow them to use your app in a partial state or not? If not, you can simply check if there are any missing scopes at all and if so, just direct the user back to reauthenticate either automatically through some mechanisms built into the appcript runtime or uh using some methods we've built into into appcript um uh objects native objects that you can just get a link and click the user can click the link after you show them a message and they can go approve that. >> And is there a deadline for when developers actually have to make these changes? >> Yes, uh there is there are deadlines. Um the changes start rolling out for appcript powered editor add-ons uh the second week of December. So that's like December 8th. >> Pretty soon. >> Yeah, pretty soon. And then for HTTP or alternative runtime uh workspace add-ons December 1st. Uh all other services like web apps and um u appcript powered uh workspace add-ons are coming in January. So this is all coming around the corner pretty quickly. >> So I know you you developed a a editor add-on or uh it was an editor add-on. Yeah. uh long time ago was uh Flubaru. >> That's right. >> And still going strong, it sounds like. Uh were you actually impacted by these changes for your add-on and did you have to uh do any work to get? >> Absolutely. Absolutely. Yeah. Flu uses a number of permissions. It's been in the marketplace for like over a decade. So long before we uh you know there was a whole review process. So I had to actually do several changes over the years like peeling back using the full drive scope, the partial drive scope. But even now it still uses uh email uh triggers um spreadsheet data of course and so in order to be and and showing users interactive mo modals and things like that. So what I've done for now is uh the first approach which I talked about which is just check that the user has granted all permissions and if not uh you know when they take an action like to create an assignment or some kind of entry action send them back to a modal that just says hey if foru or my app to work you need to please go back and authorize all permissions here's a link click it and then you'll they'll be presented with the o screen again u what I plan to do long term and what a lot of app developers will probably do is handle things more granularly perhaps there's a capability in there that is you can work the app can work without it. >> In my case, for example, I could still uh if as long as the teacher approves the spreadsheet scopes, they could still grade the assignment, but maybe they don't want Flubio having access to their email to send out the grades to students. That's fine. I could handle that more gracefully. Uh and if if the user tries to send the emails, uh it could show a message saying, "Hey, you didn't approve this scope previously. If you'd like to approve it now, click the link below. Otherwise, we can't email grades on your behalf." >> Yeah. Yeah. It sounds like that's a better user experience. Yeah. Uh but obviously with a little bit harder on the developer side to you make that change to do it on a you know per functionality basis. >> Yeah and that's what we said yesterday in the talk is you can you can actually do both phases. You can do phase one first which is just make sure all the scopes you need are present and if not has to use user reauthenticate fully. Um but you know later down the road when you have more time handle things more granularly and and fun and functionally right maybe maybe there's a feature of your app that you can actually operate without for example in the if your app does something in Gmail and calendar maybe it's possible to do the Gmail portion only and have the user not use the calendar part and just let them know and that's fine too. >> Okay yeah sounds good. So, uh, Joe, you talk your talk was actually, uh, in a somewhat adjacent area. So, uh, with talking about OOTH and scopes and everything very much >> navigating the the whole process of, uh, trust and safety and getting your apps approved for marketplace and everything. So, um, yeah, why why' you do that talk and and what what what were you hoping to get out uh to help developers with? >> Yeah, it's it's it's real timely stuff. It was it was fun coming on after after Dave and that oh the granular consent is is really a a wonderful userfacing feature that I I think folks are going to get used to and and there's not too much developer change involved to get there. And so I I I took I took the wider view of things um and uh and charted the uh using some examples from the partner ecosystem uh as I work with a lot of our really great strategic partners for Google Cloud. uh I took examples that uh that I've accumulated working with them over the last few years and and tried to share that with a wider audience of things that they need to know uh going through the entire process where folks can typically get stuck and hung up on. >> Yeah, the uh process is challenging sometimes. Um, did you have any I don't want to say silver bullets, but like you know top tips or top tricks or like just how to make that processes as easy as possible? >> Yeah, it is it is strenuous on purpose and that is that is a frustrating thing for everybody but it it is you know they are not our our Google trust and safety team. They uh they they're really good folks. They are not out to get anybody. We we take user data and privacy and security quite seriously. >> You two are well aware of I think probably our audience is well aware of as well. Um so there are a lot of things that need to be confirmed. They can't just take folks word for it and and that that can lead to a lot of back and forth with with the team. I I have my my single biggest tip that I it's a tip that I ended the presentation with is to attempt to assume positive intent whenever possible. You are only when you submit an application for review, you are going to get a email thread automatically generated with the the owners of the project, the editors of the project. Um you support email address as well. that is your only way to communicate with the trust and safety folks. It's just back and forth on that single email thread. So if if you don't understand what they're asking for, it's okay to ask for clarification. If you are having a hard time communicating something to that team that it's okay to try and phrase that. In fact, it's I encourage try and phrase it a different way. There are going to be those kinds of miscommunications, but I think it's important to to not jump to antagonistic and and and you're going to get through the process a whole lot faster. >> Joe, I think you mentioned yesterday a really good point is that a lot of these folks in trust and safety, they may be concurrently reviewing dozens, maybe even hundreds of apps. >> Absolutely. >> Not just for Workspace, too. >> Yeah, exactly. Yeah. It's not it's we the the scope of the talk yesterday was was mainly focused around Google Workspace integrations that were going to get published in the Google Workspace marketplace. But if your application touches these APIs anywhere across Workspace, Gmail, Calendar, Drive, and it's an Android app or iOS or a web app, something it's a feature in in your SAS platform, you have to go through this process. So yeah, it reaches quite a lot of folks. And if you're not used to working, if you haven't gone through the process before with with the Google Workspace um trust and safety team, I I think you don't really know what to expect. >> Yeah. And they're and they're doing their best considering all they have to go on. So, you have to be patient. >> Absolutely. >> I actually had a a partner I was working with recently and they were going back and forth and they felt like the trust and safety team wasn't understanding their use case and so we worked together to craft a table like let's let's lay it out really clearly what would happen if you did have the scope, what would happen if you didn't have the scope. And once we made it clear in a really easy to consume manner, immediately uh things started moving forward. >> Oh yeah. No, I I that's a that's a great point. I I'm a I'm a huge fan of sharing screenshots, screen recordings, uh you know, do some draw some mockups, something visual, because you're going to get different reviewers every time. There's no guarantee you're going to get the same folks. Um you're not there's no guarantee you're going to get the same reviewer even through your single app review process. So, you're going to get different communication styles and and I I think it I think the visual component can really make a difference. >> Yeah. >> Yeah. I I mean I think you made a just spot on point just not to assume bad intent and you know I will be honest when you know the process first started. Yeah. It was a little crunchy. uh we had you know a little a little little bit of antagonism uh back and forth and a little distrust but definitely over the last couple years um as we've gotten to know that team and know the people on it um yeah they actually really are good people. They are trying to um put users data first uh and and and really try to do the right thing without being you know too much of a an obstacle to developers also trying to deliver the value that they're trying to deliver. >> I agree. So yeah, it's um but yeah, definitely I mean definitely still rough edges in the process, but you know, you know, it's things we could work on, but uh but definitely absolutely assume good intent because they they really are trying to do the right thing. Uh so the other side of your talk about besides stress and safety was the marketplace side. >> Yes. Um, and is is there anything um I think it's a little bit of an easier process right now, but is there uh anything that uh you think developers should take away in terms of just making that process uh as smooth and as as possible? >> The I I really like the the Google Workspace marketplace as so my my background is I I've been consulting in the in the ecosystem. I I was I had some fun stints as an as administrator for for enterprise customers at Google Workspace. So I I've always appreciated the workspace marketplace as the place where you can find applications but also install and deploy them for a user base. um there uh and the kind of explosion that we've seen in AI powered applications over I think especially good ones over the last six months or year or so has been has been a lot of fun to see. I think it's bringing a lot of people to publish marketplace applications that have not necessarily worked with any of our APIs before. So there are a lot of great guides. I don't know if we can put something here. Um there are a lot of great guides uh available on you know that that we publish for for what this process looks like and visual guides too. I think YouTube videos and and walkthroughs um I I I think for for folks who are coming to it new the marketplace process is not you're right it is not as bad especially if you're not using restricted scope something really highly sensitive. Um, so, uh, I I think come prepared, ready to talk about what makes your app special because they're not going to know. They're the anyone in the review process, they're not going to know who you are. Um, so, you know, have have some fun stories to, you know, be prepared to talk about why your app is cool, what it's doing with Google Workspace data, why the whole ecosystem benefits from, uh, you know, your participation in it. I think that kind of rising tide really does make a difference. >> Yeah. And you you had a good point, Joe, too, in the talk about have your ducks in a row ahead of time. So, for example, make sure your terms of service are compliant and linked. Make sure privacy policies as well. Even even when it asks for your homepage, make sure that homepage, this is for Oth and the marketplace both leads to not just the homepage of your company, but the homepage of for your app specifically. >> That is that's a really fun one. That's a honestly the the majority I think of the tips that I shared are just real easy miscommunications. When somebody hears homepage, >> the first place that my brain goes to at least is oh well that's going to be my company homepage, you know, my whatever.com or >> and and that is that is not it. That's not really what they're asking for. Maybe you get lucky and that is but but when they ask for hey what's your homepage, it's it's a homepage for your application. what what does your application do and uh and you know how it's got to be a public site so that folks who are visiting can take a look and see all right this is this thing does some pretty cool stuff with Google Sheets yeah I'm on board if you just give them your your website homepage it's it's not going to do the trick and then you get confused well why did they reject me that's actually my homepage um those those miscommunications are you see them a lot >> and it's it's h it's frustrating so that A good chunk of the impetus to get back to your first question, a good chunk of the impetus for me wanting to put this presentation together is because you just when you when you've been helping partners get through this process for a few years, you start to see the really easy things that folks can fix if they knew that they were potentially problems. So, I wanted to hit as many of those as I could. >> Yeah. No, sounds great. Um uh both of you were at the summit all day I think. Um did you get to watch any other sessions and was there anything that you saw that um you know stood out? You said oh that's really interesting content or you know surprising just like what what were the highlights for you other than your own talks? [laughter] >> There were other talks. >> No I I mean I certainly enjoyed Joe's talk and some a little cool little thing he made which we'll maybe showcase later. Um, I I also enjoyed the talk that Muhammad gave on service accounts. I mean, as much as you can enjoy a talk on service accounts, but I think this is a really misunderstood um area and and not necessarily always clear to developers how to engage with service accounts to use our services and best practices in doing so. And I've seen a lot of people make unnecessary mistakes unfortunately that cost them development time later to fix. >> Yeah, that that is a topic that we've seen a lot of confusion. And I think we have a video coming out specifically on that one um coming out next month I think. >> Um and some blog posts to follow up and so on. But uh but yeah, my my my take is yeah, workspace really is for users. Um there are cases where you can use service accounts, but you kind of have to know what you're doing and and know why you're doing it before you really get in there. But uh how about you? Did you see any any talks? Uh I I got I also I very much enjoyed yours on on the granular >> patting each other on the back here. >> We really are just going just go around in a circle. >> Uh the uh honestly my my favorite I didn't get to see as many of the talks as I wanted to. Especially we had some really good technical talks in a separate room that I I feel bad that I I didn't get to see. There was some really cool AI demos that I got to talk with folks about afterwards, but I I didn't get to see them as they were happening. Uh my I think my biggest takeaway from the event is just getting so many great developers in the same room together. You know, I'm often in my role in working with uh some very specific enterprise partners for Google Cloud. I don't get to interact with the much wider community. And you know, it's it's great to see folks getting together because this is stuff that they care about. They it makes it's a it's a positive difference to them. It's a positive difference to their their customers, to their partners. This is, you know, the the ecosystem that's built up here around Google Workspace. It's not it doesn't feel like a a checkbox. People want to be here. They want to participate. And that enthusiasm is just contagious. >> Oh, absolutely. I mean, that that for me that's the best part is I mean the the sessions are great. Both of your sessions were were fantastic and I saw uh even some showand tell sessions at the end of just some of the the attendees getting up impromptu and sharing some of their ideas and projects and they were all fantastic and really just you know inspiring to see what people were building. But at the end of the day, yeah, the real value for me is the conversations uh during lunch, during, you know, the the closing uh just on the breaks and yeah, being able to, you know, catch up with people or even and meet a whole bunch of new people that I had no like didn't didn't know didn't know anything about their company, but then they're like, "Hey, we're doing this thing." It's like, "Wow, that's like actually really cool." So, I just love to be able to to have those conversations and and hear the stories. >> Yeah, agreed. I got to actually meet folks behind some integrations that have been going strong for over a decade and yet I never knew the people behind them or the people supporting them. That was a real treat for me to get to talk with them >> and understand, you know, what's working for them, what's not working for them, and how we can better support them. >> Oh, absolutely. Yeah. Uh so yeah, uh David, you you mentioned a fun little thing and I do I do have it here. Um this is uh I don't know if we'll be able to get it on camera, but this is a >> I love this >> a children's book. uh with Joe here. Can you how how did this come about? Right. I think this is super cute, super clever. >> Thank you. >> Um but yeah, what's what's what's the story here? >> This was this was a very silly thing that I had a lot of fun putting together. Uh so we one of the benefits I think of being in an organization like Google especially in a moment like we have right now is that there are so many cool AI tools that are that are across the entire spectrum from you know enterprise down to consumer. And one of the fun consumer tools that we released recently was Gemini Storyteller. And this is a uh at at its simplest, you just give storyteller a little prompt about, you know, I I've got a 5-year-old daughter and I would like to talk to her about the train system in California, and it'll make a nice little uh story to to teach them about it with with pictures and everything. I I took my presentation about navigating the Google Workspace Marketplace review process as the input and it gave me um Appy's Great Adventure, which is just the story of an app going through the entire review process with the with the the same watch points that I I talked about with the homepage and brand verification and API OOTH scopes, but but written very simply. And I think Yeah, I think it turned out pretty adorable. >> Yeah. No, it's fantastic. And And so was it going from Gemini to hey, here's some, you know, a little digital story book to just the the actual printed thing. Was that was that was that easy? Was like what what did you have to do to do that? >> Yeah, it was. I I I mean I would selfishly I would love if uh if there was a print now button at the end of the Gemini story. I I would buy these for every family member until they got sick of them because I I think they are they're really wonderful. Um but I but I had to uh I I I had to put it together. We've got some we've got some images and text in here um that I I pulled out of the the storyteller. I I did use Nano Banana, which I think everybody is loving these days. >> Oh, yeah. It's fantastic. >> Uh some of to to tweak some of the images so that uh I was recognizably me uh image >> in the book. Thank you very much. And uh yeah, it was so it was just Gemini Storyteller Nano Banana for the images and uh and you can buy these board books from a whole bunch of different print to print places online. Really relatively inexpensive. Like it was it was a very fun oneoff. I didn't expect it to get the reception. >> I I showed I walked around and showed that book to a couple different uh vendors and who've been through our process and they they loved it. Everyone was lighting up over it. It kind of reminds me of of a book you'd show your young son or daughter like before you go to the dentist or the doctor the very first time like what what to know, what to expect, why not you shouldn't be scared. These are the things you're going to encounter. >> Uh it's terrific. >> Yeah. Please. Yeah. Uh there's no need to be scared of going through the app review process, right? We want to make sure that we've got we provide all the the information that they need to get through uh in a in a quick manner. I think uh I think that definitely plays into it for sure. Good call. >> Yeah. Well, yeah. Thank Thank you for doing that. Um yeah, I want to thank both of you for joining us today and for uh and for yesterday as well. Um so yeah, any any last thoughts before you wrap up or >> No, you know, I don't I don't think I I mean you you you definitely echoed uh the the same thing that I I came out of it. My biggest takeaway was was just getting to meet the folks. Did you get to see any presentations or uh >> I did. Yeah. >> Yeah. I was uh I was uh up in I was in one of the tracks uh just uh MCing and helping people get in and out. So I got to see a few talks on a lot of AI. Uh Justin from my team did one on vibe coding for workspace and using different api tool or different ai tools uh ranging from Gemini to Gemini CLI and jewels >> uh different techniques for how to um you know prompt them and provide the right context. uh especially for workspace. Um he also uh has been working on some new tools to help that. So we have a >> uh MCP server >> I saw that helps uh give the the LLM's access to um up-to-date documentation, right? I mean that's one of the things when you have these models that are trained on the internet like that information gets stale. So being able to give it live data uh live documentation helps a lot. And there yeah there there a couple good gems in there with some some funny jokes and everything that were fantastic. Um and uh and then yeah some of our we had a a talk from one of our GDEs Alan Penberg. He did one about building agents and uh echoed a lot of the same similar things that Justin has discovered in working with these agents about um doing a higher level abstractions around the APIs and sort of trying to simplify the complexity so that they're they're effective. Um but yeah and then a few others uh actually gonna be chatting with our appcript PM about some of the new things that are coming up there. Great. >> Uh that was a great talk as well and and and really one of the highlights was the showand tell session. >> I wish I could have seen some great things. Yeah, we had a handful of folks come up um you know 5 10 minute impromptu uh talks and there were some it was it was everything from really clever workarounds for having to do like dynamic content in emails. Um it was uh one of yeah one of our partners did that and it was really clever like wow how did you do that you know um I don't want to give too much about how like how what what their secret sauce was but it was really clever um a couple startup ideas from university students um neat >> uh yeah one's uh lots of AI based solutions uh with workspace and so on just fantastic to see people and I and I I I truly appreciate it um you know because it takes courage to go up there unprepared >> and just do a talk on an idea that you don't know if people are going to like. Um, but they they they were fantastic. >> I it's just another example of the the community that's built up around Google Workspace and and and these these platforms. >> It's a very it's a very wonderful, encouraging, smart, and talented group of folks. Absolutely. Constantly impressed at the things that folks are coming up with. >> Oh, yeah. Could I couldn't say better. Yeah. >> Yeah. I want there were a couple big wins for me. I mean I just seeing everyone connect for one like that that's amazing because you see people sitting next to each other who don't know one another but they have similar problems right and they suddenly realize oh you have that problem too like they change change emails and part of that developer community is it's it's formed by just those happen stance kind of meetings which is great. Um, and also just talking with a lot of these folks yesterday who've been developing in in the workspace ecosystem starting with Appcript as far back as 2010 2011 when it first came out. >> I thought I was one of the few left who still had an app that was that old. No, on the contrary, uh, and and and talking with them about how how it's changed over the years and how it keeps improving and the impact that it can have, right, uh, for for users and for the for the people they build those apps for is it's it's really phenomenal and and just reminds me of how >> awesome that that power is of of Appcript and of Workspace Marketplace, etc. in general. >> Absolutely. I'm I'm excited to hear the conversation that you have with our our Google Appcript PM later because there's I've heard that there's so much more interest in in Appcript now that >> folks are able to vibe code with Gemini and and get help >> getting into that where they wouldn't have otherwise. >> Yeah, we we've seen a big uptick and uh yeah, we used to we used to joke many years ago Appcript was like the the best kept secret that we had and it it's it's not a secret anymore. So, um, yeah, the usage is is really starting to take off and, uh, and just the things people are building these days is is it's kind of mindboggling. You're just like, "Wow, you like you did that in that script." Like, man, good for you. >> Wonderful. >> Yeah. All right. Anyway, thank you very uh both of you very much. Um, appreciate your time and and we'll see you around. And >> I know I know we're in the same office and never see each other unless we're traveling, but hopefully one of these days we'll uh we'll we'll actually see each other in the office. >> Yeah, I'll make more books. Well, we need a setup like this in Boulder. I don't have that full line of people waiting for you to sign an autograph. >> Uh, I should sign this one. [laughter] Yeah, in Boulder, we're gonna have the book signing. >> Done. Promises made. >> All right. I appreciate your time very much. Thank you very much. And yeah, take care everyone. Relax.