How to Fix Google Apps Script “This app is blocked” Lock When Deploying Web Apps

Lounge Tips & Tricks
1

Hey everyone,

While turning a regional health indicators dataset into an interactive web app dashboard using Google Apps Script, dynamic filters, and spatial mapping, I ran straight into an immediate deployment roadblock.

At first glance, it looked like a standard network or authentication timeout. But after checking multiple connections and reloading, Google consistently threw a hard security block:

This app is blocked

This app tried to access sensitive info in your Google Account. To keep your account safe, Google blocked this access.

Unlike the typical “Google hasn’t verified this app” warning where you can click Advanced and proceed anyway, this was a hard stop—no bypass button, no advanced link, just a flat refusal.

After stepping through the authorization lifecycle to trace the root issue, here is why this happens and how to resolve it cleanly.

What Causes the Block

The issue boils down to implicit OAuth scope escalation:

  • Unscoped Drive Permissions: When you use SpreadsheetApp inside Apps Script without explicit boundaries, Google’s compiler infers permissions and requests read/write access across your entire Google Drive. For unverified web apps, Google’s security heuristics flag this broad scope as a sensitive/high-risk violation and block execution entirely.

  • Standalone vs. Container-Bound Isolation: Running a standalone script (script.google.com) that accesses private sheets marks the script as an untrusted third party.

  • Multi-Session Collisions: Multiple active Google accounts in the same browser session can scramble OAuth redirect tokens.

How to Fix It

The fix requires explicitly constraining the app’s access radius directly in the code and manifest:

1. Enforce Document Boundaries (@OnlyCurrentDoc)

Add this JSDoc annotation at the very top of Code.gs. This instructs the runtime parser to limit scopes strictly to the active container document:

JavaScript

/**
 * @OnlyCurrentDoc
 */

2. Declare Minimal Scopes in appsscript.json

Open Project Settings > check Show “appsscript.json” manifest file in editor, and override the default scopes:

JSON

{
  "timeZone": "Africa/Lagos",
  "dependencies": {},
  "exceptionLogging": "STACKDRIVER",
  "runtimeVersion": "V8",
  "webapp": {
    "executeAs": "USER_DEPLOYING",
    "access": "MYSELF"
  },
  "oauthScopes": [
    "https://www.googleapis.com/auth/spreadsheets.currentonly",
    "https://www.googleapis.com/auth/script.container.ui"
  ]
}

Setting https://www.googleapis.com/auth/spreadsheets.currentonlysignals to Google’s OAuth gateway that the script touches zero files outside this specific sheet, removing the sensitive scope lock.

3. Deploy Under a Clean Version

Create a new deployment version under Deploy > New deployment. The hard-block screen will revert to the standard developer consent prompt, allowing the web app to run normally.

If you’re building web apps or dashboards on top of Google Workspace APIs and hit this screen, don’t waste time troubleshooting your network setup!

:backhand_index_pointing_right: Full write-up and step-by-step breakdown:

https://chifen.is-a.dev/blog/resolving-google-apps-script-this-app-is-blocked-when-deploying-web-apps/

Has anyone else encountered this implicit scope lock when building internal tools or standalone web apps with Apps Script?

1 Like