Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I recently tried to integrate Gmail in my app [0], and I poured too much time on it. I decided it is not worth to support Gmail.

Gmail to SQLite describes 6 steps to get credentials working, but it is not true for me. After 6 steps:

- that Google said that my app was not published, so I published it

- Google said that app cannot be internal, because I am not a workspace user

- for external apps

- then it said I cannot use the app until it is verified

- in verification they wanted to know domain, address, other details

- they wanted to have my justification for scopes

- they wanted to have video explaining how the app is going to be used

- they will take some time to verify the data I provided them

It all looks like a maze of settings, where requiring any of users to go above the hoops required by Google is simply too much.

Links:

[0] https://github.com/rumca-js/Django-link-archive



The steps Google makes people jump through just for API keys are absolutely insane.

Does anybody have insight as to why it’s so bad?


Probably because if you get API access to someones email account it is game over. And people are stupid so some of them are going to click yes to some scammy app. And then they will blame Google for not protecting them.


Because otherwise tons of people anonymously create api keys with extremely wide scopes for small / low quality apps.

When those inevitably get used for nefarious purposes; Google image suffers as a result.


Use regular old IMAP with an app password.

Don't jump through their hoops.


Every year the imap option ("app passwords") gets buried deeper and deeper in the settings.


Indeed. Quite a hassle to enable now. Multiple requirements including 2FA.




Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: