How to get a Lovable app through Google OAuth verification

Your Lovable app works in testing. Then Google asks you to verify the OAuth client because you touch Gmail, Drive, Calendar, or other sensitive scopes. Founders freeze here — not because Lovable is broken, but because provider review is a product and compliance process, not a prompt.

#What “verification” actually means

Google (and similar providers) review apps that request user data beyond basic profile. They want a clear homepage, privacy policy, limited scopes, and proof that only the user who connects can access their data. Lovable can generate the UI; you still own the OAuth consent story.

#Prep checklist I run with clients

• Production domain on HTTPS with matching OAuth redirect URIs (preview URLs fail reviews).
• Public privacy policy that names the data you store and how to delete it.
• Minimal scopes — do not request Drive full access if you only need one folder.
• Per-user tokens stored securely (never in a shared Supabase row without RLS).
• A short demo video showing login → connect Google → use one feature → disconnect.

#Common rejection reasons

• Redirect URI or branding does not match the live app.
• Privacy policy is a placeholder or missing deletion instructions.
• Sensitive scopes with no clear in-app use.
• Test account credentials missing or app stuck in “Testing” with no path for reviewers.

Google OAuth review pack:
[ ] Live URL = consent screen homepage
[ ] Privacy policy URL live
[ ] Scopes list = features shown in demo
[ ] Reviewer test user + password
[ ] Disconnect / revoke works in UI

#Lovable + Supabase note

If tokens live in Supabase, treat them like passwords: encrypt at rest when possible, RLS so user A never reads user B’s refresh token, and a server/edge path for refresh — not the browser. That is the same discipline as any production OAuth app; Lovable does not remove it.

#When to get help

If you have been rejected twice or you need Gmail/Drive scopes for a real product, stop guessing. I harden the auth path, cut scopes, and prepare the review assets so you are not blocked on launch day.