Publish your app to production to fix 7-day logins and the 100-user cap
Refresh tokens dying after 7 days, a hard cap at 100 users, and the unverified screen are all one symptom: your OAuth app is still in 'Testing' and was never published to production.
An app left in 'Testing' never actually enters verification. Google caps it at 100 test users, shows everyone the unverified warning, and expires refresh tokens after 7 days — which is why users keep getting logged out and asked to re-consent. Verification can only start once the app is published to 'In production'.
Each fix below traces to a requirement Google publishes.
Nothing here is our opinion. Every requirement links to Google’s own page — open it and verify the fix yourself before you resubmit.
“Publish the app from 'Testing' to 'In production' before submitting — Testing caps you at 100 users, shows the unverified screen, and expires refresh tokens after 7 days.”
“Every requested scope is classified non-sensitive, sensitive, or restricted — the category is shown per scope in the Cloud Console, and it decides your verification path.”
“Set a support email and developer contact you actually monitor — review correspondence goes there.”
Do these in order.
- 01
Open the Audience page
In the Google Auth Platform, go to the Audience page for your project — this is where the publishing status lives.
- 02
Publish from Testing to In production
Change the app's status from 'Testing' to 'In production'. This is what lifts the 100-user cap and the 7-day refresh-token expiry.
- 03
Set a monitored support contact
Make sure the support email and developer contact are addresses you actually watch — Google's review correspondence goes there.
- 04
Submit for verification
With the app in production and branding frozen, submit for verification. If you only request sign-in scopes, brand verification may be all you need.
See exactly what Google’s crawler sees — free.
Paste your URL and scopes. The pre-check fetches your homepage the way Google does, finds your privacy-policy link, and flags the blockers this rejection is about — in seconds, no signup.
Straight answers.
Why do my Google logins stop working after a week?
Your app is in 'Testing', where refresh tokens expire after 7 days. Publishing to 'In production' removes that expiry.
Why am I limited to 100 users?
The 100-user cap is a property of Testing mode. Publish the app to production to lift it, then submit for verification.