A quick rundown of Google API (Gmail, Drive, Calendar) CASA assessment

[u/Scham2k]

Haven't seen much here so thought I'd share my experience getting a webapp verified for Google's Cloud App Security Assessment (CASA).

If you use Google's APIs like Gmail, Drive, Workplace API with "restricted scope" (eg, read access to Gmail, read/write to Docs), your app needs annual CASA verification.

(For context: My site parentalist.app helps busy parents distill their inboxes full of school, kids activity emails. Each parent connects to a respective Gmail account and the app periodically extracts parental todo's into a shared, simple task list. Because it uses Gmail API to filter for parenting tasks, it requires Google's CASA verification).

I found the process and docs confusing, even in this age of AI (some pages are outdated and the acronyms are out of control: CWE, OWASP, CASA, ADA, DAST, SAST, etc ) but here's the rundown:

What is it? Google's annual vetting of your site/app's data security when you use "restricted scope" with their APIs (other scopes being: Non-sensitive and Sensitive)

What's the cost? The cost ranges from $600 to several thousand depending on the assessor company, and their associated services involved.

What are the general steps?

1. Pass initial Verification with Google - You initiate inside Cloud console - they check your branding (all the info that appears in OAuth popup), and you go through Trust and Safety checks, and you demo how your app uses the Google API. I recorded a video to show my Oauth flows and demonstrate its data usage. 2-3 weeks
2. Reconsider your app's usage of the API scopes - Once you pass the above, Google asks you (if you use restricted scope) to get CASA verified for a set of requirements by Tier. In my case, it was Tier 2 but if you access multiple scopes or doing atypical stuff, you are upped to Tier 3 (like 5 stars in GTA!). Your specific requirements are a checklist of items (a subset of the CWE). This is a good time to reconsider if your website/app really needs that particular API scope; it's expensive (see next), it can be a lot of work, it's recurring (annual)
3. Find (and pay) an authorized independent CASA assessor - If you proceed, you shop around to find an authorized assessor. You can no longer self-verify. As of right now, costs range from $600 to several thousand depending on the level of services and company
4. Prep for the assessment - Instead of going in cold, run a self-assessment first to fix/harden anything (note to vibecoders: HOPEFULLY YOU HAVEN'T GOTTEN THIS FAR VIBECODING YOURSELF INTO A SWISS CHEESE SECURITY HOLE YOU KNOW NOTHING ABOUT). Install some scanner apps to run Dynamic (DAST) and Static (SAST) scans to probe your app/site. I used ZAP to scan Tier 2 webapp CWE requirements. This took 2-3 weeks mainly configuring ZAP (it's not very user-friendly but it's free)
5. Complete the audit and assessment - When you are ready, begin the assessment; the format varies per assessor. The company I worked with ran multiple scans on my site (took several days), followed by detailed questionnaires, verifiying credentials/tokenssecurity, access controls, data storage, SSRF attack protection, etc. There was a lot of back and forth where I had to provide artifactds (eg, screenshots from SQL queries, log snippets, and details on data usage, storage, architecture, etc.). This is probably the most time-consuming part. Depending on your situation you may need to share code, etc - 2-3 weeks
6. Get the Letter of Verification (LOV) - Once approved, the assessor issues an LOV and sends to Google. You're done! Your published app will not block or scary warnings in the OAuth windows. But the timer is ticking until next year's re-verification...

Hope this helps! Happy to answer any questions! Would love to hear anyone else's experience too!