Repository navigation
Built-in OAuth client: read-only Apps Script scopes blocked #1176
Description
I’m using Windows, Node 24.19.0 and clasp 3.4.1. With the built-in OAuth client and login --use-project-scopes, I requested only:
https://www.googleapis.com/auth/script.projects.readonly
https://www.googleapis.com/auth/script.deployments.readonly
https://www.googleapis.com/auth/userinfo.email
Google blocked the app before displaying the permissions list: “This app is blocked. This app tried to access sensitive info in your Google Account. To keep your account safe, Google blocked this access.”
I stopped the authorization attempt. This is a configuration question, not a confirmed bug. Does the built-in OAuth client support this scope set? What is the officially supported least-privilege configuration for reading Apps Script content, versions and deployments without the full default clasp scopes?
Activity
tudoparasuafestape-dot commentedon Oct 17, 2026
Update, 2026-10-17: reproduced on Windows 10, Node 24.22.0 and clasp 3.4.1. Using the built-in OAuth client with --use-project-scopes and only script.projects.readonly + script.deployments.readonly, without userinfo.email, Google still displays “This app is blocked” before the permissions list. I stopped the attempt. Could a maintainer confirm the officially supported least-privilege configuration for reading project content and deployment metadata? No authorization grant or deployment was confirmed.