Composio

We white-labeled the Composio Google tools, such as Gmail. Now I am trying to make the app public in GCP. According to Google, does this require CASA Tier 3 verification? Is that correct?

Hey <@804654027177721877> , yes, you'll need CASA Tier 3 verification to make your app public.

Is there any downside, if we don’t do that?

<@804654027177721877>, you can get complete understanding of CASA verification here: https://deepstrike.io/blog/google-casa-security-assessment-2025

https://support.google.com/cloud/answer/13465431?hl=en

<@804654027177721877>Here are some more useful details:
- There are a few downsides to not getting Tier 3 verification. Users will see a warning that the app is not approved, and in some cases, they may encounter the “app blocked” error, preventing them from completing the authentication.

<@1372232551145410560> in casa tier do we need to provide source code and cloud access to them?

like if composio goes through the same process, does composio also provide the source code to them like TAC security ?

Hey <@804654027177721877>, you do not need to share any source code to get CASA tier-3. They will guide you through the process and you might've to share some demo videos on how you'll be using the sensitive scopes.

<@1372232551145410560> can we have a meeting?

Hey, someone from Google will be better equipped to answer your questions as the process for obtaining CASA tier-3 is bound to change.

i have general questions in my mind and confirm the process with you, as they were asking source code, kind of strange

In that case, they might be asking about relevant snippets related to authentication handling and API calls. It is highly recommended to get all your queries answered by them instead.