I intend to sell copies of a Google Sheet with bound scripts that trigger two OAuths scopes,https://googleapis.com/auth/spreadsheets and https://googleapis.com/auth/script.send_mail. Customers will receive a URL that opens a copy of my original sheet. I am told that verification will not travel with the copy. But is the same true of the auth cap? Can a thousand customers open a copy and answer the auth questions without hitting the cap?

CodePudding user response：

The 100 user cap is a limit for unverified apps. In this case, an "unverified app" refers to the GCP project used as medium to connect to the Google APIs.

As mentioned in the comments by @Ruben, each Apps Script file is connected to its own unique GCP project. Each project has a 100 user cap so if you're just distributing copies of the file then you can give out as many as you want and they will all have their own limit. They would only run into an issues if they happened to share the same file with 100 other users, though this is kind of a moot point since once they have a copy they can keep creating their own copies anyway.

Also of note is that the amount of scopes doesn't matter here. Going through the consent screen counts as one authorization regardless of how many scopes it has.

In short, if all users are using the same script, or different scripts with the same standard project attached, then you have to verify the app or take the 100 auth limit into account. If they're just getting copies of the script with default projects then there's no problem.