We have a situation where we have reduced our use of restricted scopes for the Google Drive API. Our app has been re-verified, all use of restricted scopes has been removed and everything ought to be good. For most users, and all new ones, it works fine.

However, it seems that if a given user previously had been issued a token with the restricted scopes, if they again try to use the API, they get the “unverified” dialog. Google have confirmed that this is the case.

We have been through and revoked individual consent for all the tokens we have had stored, but it seems there is still a risk that the user can have stored a token that we are not aware of or have previously purged. Hence, no way to revoke.

And as most users will give up when they get this screen, it’s hard to see if it is happening and to whom. (If they do click through on the Approved / unsafe links, then we do get to see their token, and can revoke it again, but if they don’t, we have nothing to go on.

Is there any way to “revoke all”, or alternatively interrogate users via the API to find what scopes they have had granted?