Verification and publication

[Mark Grimshaw-Aagaard]

Hi all,

I've now developed my Google Docs add-in and am trying to understand the verification/deployment procedure. Most google links and FAQs I follow for this send me down a rabbit-hole of bewildering terminology and situations that do not seem to fit my case. Is my add-in an 'OAUTH client', do I need the Google Cloud Platform for 'scalable, production-ready enterprise workloads', do I need to edit my manifest file, do I need a web page describing the add-in, is there a cost involved???? Really, I've no idea and have even less idea after reading the masses and masses of jargon and documentation.

Here's the situation:

1. I'm an individual writing open-source, free software for individuals and organisations to use as they see fit. The software (WIKINDX) is basically bibliography and citations management for academics and researchers.

2. The add-in (which is a conversion of a Word add-in) inserts references and citations in the document and then, once the document is written, all references can be converted to a chosen citation format and a bibliography appended.

3. The inserted references come from an external source (the user's wikindx) which the user inputs and stores in the add-in.

4. There's no emailing, no access to google drive etc. etc. etc. – all the add-in does regarding access to data is insert external text from a user-determined, non-google source in the user's document.

Can someone in plain language guide me through the simplest, quickest route to verification/publication so that anyone using my wikindx software and who has a google account can then set-up the add-in for use on their documents?

Thank you in advance.

[Alan Wells]

Your add-on does have an OAuth client ID.  Even though you are probably not using an OAuth library for your add-on, the OAuth is done automatically by the Google built-in or advanced services.  The documentation fails to explain that.  So, as far as the OAuth client ID, the documentation for add-on set-up is a complete failure in explaining what that means.  The OAuth client ID is shown in the address bar at the top of the permissions dialog of listed permissions that the user must authorize.   You will be asked to provide a YouTube video showing the OAuth client ID, so what you must do is to widen the authorization dialog because the dialog box is narrower than the length of the client ID.  None of this is explained anywhere.

You can't publish an add-on without creating a Google Cloud Platform project and associating it with your Apps Script project.

You must use the Workspace Marketplace SDK in order to list your add-on in the Workspace  Marketplace, and the Workspace Marketplace SDK is something that you must enable in your Google Cloud Platform project.

Do you need a website? Yes.  You can create a website for free.  I use firebase hosting for my website.

The only cost I have to my add-on is my Google Workspace account.  You can get a basic account for $6 dollars a month.  The main issue, is for Google to be able to identify who you are.  You might be able to use a free Google account, but then you'll need to set up something, I can't remember what it's called, maybe an organization account.  You'll need to do that anyway.

So, at the minimum, the cost is $6 dollars a month for a Google Workspace account, IF you want to be listed in the Google Workspace Marketplace.

If you don't care about being listed in the Google Workspace Marketplace because users have a way to know about your add-on and can find it on the web, then you could maybe use a different way for users to install your code.  But, you'd still want to get your Apps Script project verified so that users don't see the warning message.

If your code asks the user for permission to modify the Google Doc, then you'll need to list the "scope" for that in 3 different places.

1) appsscript.json manifest file.

2) OAuth consent screen

3) Google Workspace Marketplace SDK App Configuration.

The problem with someone providing a complete, easy to understand guide to publishing an add-on, is that it's work.

Lot of work, little or no reward.

If you want to have a listing in the Google Workspace Marketplace, then there is no easy way to do this.

If your users are willing and able to use the Apps Script code editor to get a copy of, and use your code, then you could provide a way for them to get a copy of your code.

But chances are, most of your users might not be willing or able to do the set up to get a copy of your code and run it.

If you don't want to be published as an add-on, another option is to provide your code as a library.

You can also publish your code to a public repo, like GitHub.

You could also provide a Google Doc that is shared to the public with a bound script that users could copy.

When they copy your Google Doc, their new copy will also have a copy of the code bound to their new file.

[Boris Baublys]

Hi Mark. The add-on publishing process is bureaucratic. Bureaucrats also got there :-) Although sometimes it is clear that someone is trying to humanize this process a little. Alas, this is impossible, because bureaucrats have real power. Most likely, these are the intrigues of competitors :-) They infiltrated their agents into Google so that future Elon Musks and Steves Jobs of Programming would publish their masterpieces on the Marketplace less often :-)

If no kidding, then just go in order in accordance with this instruction: https://developers.google.com/workspace/add-ons/how-tos/publish-add-on-overview

понедельник, 22 марта 2021 г. в 17:05:36 UTC+3, aj.a...@gmail.com:

[Mark Grimshaw-Aagaard]

Thanks Alan and Boris for the prompt responses and for taking the time.

I guess I will have to go through Marketplace as many of my users will not know how/want to mess around with scripts and libraries.

I do though have GitHub and sourceforge accounts. However, I get the impression from your post that this is not as easy for users to use as browsing and installing an addon from Martketplace.

How do I know what needs to go into the manifest file if I myself get no errors or warnings about permissions? I get no screen asking for permissions – perhaps I did when I started the coding but I can't remember. I did get an error last week about UrlFetchApp but managed to get rid of that without changing the manifest. Anyway, I'¨ve added these:

"https://www.googleapis.com/auth/documents.currentonly",

"https://www.googleapis.com/auth/script.external_request",

"https://www.googleapis.com/auth/script.container.ui"

but really feel like I'm flying blind.

I've read about the need to make a YouTube video here but have yet to come across such instructions in the documentation. I can't find any videos of this nature on google docs (searching simply provides videos on how to install addons or an overview of selected ones) – any chance you could provide a link to yours so I can get it right first time?

I have a website I own so no problem there.

I will slowly work through the verification and publishing process over the next few days. No doubt I'll be back with more questions. . .

[Kim Nilsson]

Let someone else in your organisation, or just create a new Gmail account and, copy your document to that account, and let that user run the code.

That user will then have to authorise everything from scratch, and you will see what a new user will have to go through to make your code work.

[Boris Baublys]

See what should be present in the demo video here: OAuth API verification FAQs.

And all this FAQ will be useful.

вторник, 23 марта 2021 г. в 13:59:56 UTC+3, Kim Nilsson:

[Alan Wells]

If you are using the new code editor, then the scopes needed are automatically listed in the "overview"

Scroll down to the bottom.

https://script.google.com/home/projects/

For the legacy editor:

File menu -> Project Properties -> Scopes Tab
The code editor will often automatically use a scope that is more permission than you need.

In that case, you'll need to view the documentation for more restricted scope alternatives.

RECORDING A YOUTUBE VIDEO

I use 

https://www.flashbackrecorder.com

[Mark Grimshaw-Aagaard]

Thanks Alan,

I think the three I listed are shown in the overview already. So all should be fine.

[Mark Grimshaw-Aagaard]

So, I'm slowly working my way through the preparation for verification. Here's my first issue trying to prepare my manifest:

Following this, I apparently have to have a 'common' section. So my manifest is:

{

"common": {

"name": "WIKINDX",

"logoUrl": "https://www.wikindx.com/wikindx-addins/wikindx-128.png"

},

"timeZone": "America/New_York",

"dependencies": {},

"exceptionLogging": "STACKDRIVER",

"runtimeVersion": "V8",

"oauthScopes": [

"https://www.googleapis.com/auth/documents.currentonly",

"https://www.googleapis.com/auth/script.external_request",

"https://www.googleapis.com/auth/script.container.ui"

]

}

I try to save, I get:

""appsscript.json" has errors: Invalid manifest: unknown fields: [common]"

. . .

[Adam Morris]

You need to have all that wrapped in an addOns property. That’s what is meant by “addOns.common”

addIns: { 

   common: {

    ...

   }

}

--
You received this message because you are subscribed to the Google Groups "Google Apps Script Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-script-c...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-script-community/1841e5d7-bf28-417d-9f6c-63f38677d0ddn%40googlegroups.com.

--

http://classroomtechtools.com

[Kim Nilsson]

addIns or addOns ??

Kim

[Mark Grimshaw-Aagaard]

. . . "addOns" – thank you.

On Wednesday, 24 March 2021 at 13:54:25 UTC+1 Kim Nilsson wrote:

addIns or addOns ??

Kim

[Bruce Mcpherson]

This might help - you can use it to search for apps like yours from all published on github, and see their appsscript.json

for example...

https://scrviz.web.app/?manifest=googleworkspace%2Fadd-ons-samples%2Fapps-script%2Florem-ipsum%2Fappsscript.json

--

You received this message because you are subscribed to the Google Groups "Google Apps Script Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-script-c...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-script-community/a8770685-2d18-417f-98d5-e5e10ec476b7n%40googlegroups.com.

[Mark Grimshaw-Aagaard]

Thanks for all the advice so far. I've now got through domain and OAuth verification and have received this puzzling reponse back:

>>>>>>
Dear Developer,

Thanks for submitting a verification request.

If your app doesn't need to display an icon, you can skip the verification process. If you do skip the verification process, the existing functions of your app won't change, as long as the scopes used by your project don’t change.

Otherwise, if you’d like to continue with the verification process:

1. Make sure you’ve completed all the required steps.
2. Reply directly to this email to let us know.

The review process can take up to 6 weeks. Thanks for your patience during this period.

<<<<<<<

1. The previous email I got asked me to complete the domain verification to finish OAuth verification and the email above is in response to my reply that I had now done so. The email does not make it clear that I have indeed passed domain and OAuth verification but I assume that's the intent – now move onto the next stage.

2. And here's where I'm puzzled. What icon are they talking about? An icon on their market place? An icon in the app? An icon in the google docs menu? If it is an icon in the market place then I'm not bothered: users of the app must use the external software the app interfaces with and so will know about the app from my website.

3. But, if this is the case, and I skip the (next) verification stage, does my app indeed appear (iconless) on the google market place so my users can download it?

Has anyone faced this before?

Mark

[Alan Wells]

Did you upload any images for your add-on?

[Mark Grimshaw-Aagaard]

The only one I've uploaded so far is the required app logo of 120x120px.

[Mark Grimshaw-Aagaard]

Perhaps it is referring to this:

"All apps that access Google APIs must verify that they accurately represent their identity and intent as specified by Google’s API Services User Data Policy. If you change any of the details that appear on your OAuth consent screen, such as the project's icon, display name, homepage or privacy policy URL, or authorized domains, you need to have your app re-verified for branding prior to updates being published to your OAuth consent screen. This brand verification process typically takes 2-3 business days." (https://support.google.com/cloud/answer/9110914?hl=en).

Maybe it's the google icon as suggested here: https://developers.google.com/identity/branding-guidelines

My consent screen (after presumably passing the OAuth verification) still show minimal data asking the user to consent to the app's use in their document and nothing else. I'm not too bothered about that. I am curious though about how to get information onto that consent screen.

Mark

[Alan Wells]

In the Store Listing:

https://console.cloud.google.com/apis/api/appsmarket-component.googleapis.com/googleapps_sdk_publish?authuser=0

The 32x32 and 128x128 App Icons are required.

See the asterisk noting that it's required.

[Mark Grimshaw-Aagaard]

Well, perhaps I'm still several stages behind you. I go to my GCP project dashboard and cannot see anything to do with store listing much less anything telling me something about icons. If I look at my OAuth consent screen, I get the screen below.

Despite doing domain verification and getting an email back in response to my email confirming I had done that, I still apparently have domain verification pending and action to be taken by me.

I'm completely lost.

[Alan Wells]

You need to enable the Google Workspace Marketplace SDK, and use that.

If you haven't enabled the Google Workspace Marketplace SDK then you need to do that.

In your main/default Google Cloud Platform dashboard for the Cloud Project,

https://console.cloud.google.com/home/dashboard?authuser=0

you'll see something like the following image and you need to click go to API's overview.

Then click on the Google Workspace Marketplace SDK link.

[Mark Grimshaw-Aagaard]

Thanks. That's now done but I still find nothing that seems like a store listing where I need to put in icons.

However, I'm still not sure from the mail I got from google whether I need to do this. If the icon being referred to is an icon in the access consent screen and that's all, then my question is can I get away without having it and still have my app available for anyone to use in the store/marketplace or whatever? It appears to be the difference between being verified right now or having to wait up to 6 weeks.

[Alan Wells]

From reading that email from Google, the impression that I have is that you weren't going to be approved at all unless you fixed the issue.

That statement about the 6 weeks was just generic information I believe.

I'm not sure exactly what they want from you, and that has happened to me an others many times.

They do that all the time.

The API's and Services OAuth consent screen is separate from the Workspace Marketplace SDK.

That can be confusing.

You must fill out information in both the OAuth consent screen and the Workspace Marketplace SDK.

The OAuth consent screen is not part of the Workspace Marketplace SDK.

• Your branding must be consistent in the OAuth dialog and on your website.  See: https://mail.google.com/mail/u/0/#inbox/FMfcgxwJXLdhxvGqflGzgLGDqLbjTwph

  • The branding on the OAuth dialog and the favicon for your website needs to be the same.

Even if you publish an add-on privately to the Workspace Marketplace, you still need to get your Apps Script project verified in order to avoid the warning message and be able to have more than 100 users install it.

You can't navigate to the Workspace Marketplace SDK through the API's and Services section.

It looks like you haven't correctly completed the Search Console verification process.

Did you click the "Learn More" button?

What is the link to that?

[Mark Grimshaw-Aagaard]

Thanks for your patience and advice Alan,

Regardless of their email which makes no mention of it, it appears verification is held up in the search console on something called breadcrumbs(???). When I went through domain verification, I actually went through website verification (because my software website is on sourceforge) by downloading and storing the supplied file. I clicked on verify after that and got a success message. Hooray! It's verified! Little did I realise that the domain/website was not actually verified at all – a programmer colleague told me to look at the search console (which existence I had no idea of). I'll fix the issue and hopefully that will get me back on track.

I've still no idea what the icon email refers to but it sounds to me like the safest course is to assume google also has no idea and so I should take the long route to verification and do all icons etc. I assume fixing the breadcrumbs issue will open this route to me . . .

Mark

[Alan Wells]

Okay, sounds like you've got a plan.

When you get your add-on published, post to the group so we can take a look.

[Mark Grimshaw-Aagaard]

. . . the best-laid plans . . .

This morning, I finally received the news that my OAuth App Verification request had been approved.

So, I immediately move onto marketplace listing.

First created a 'version 1' deployment which I can now see under 'Manage Deployments' and it has a 'Deployment ID' which I use below.

On the App Configuration page for Google Workspace Marketplace SDK, I need to put in a load of data including various IDs. Two fields required under 'Docs Add-on' are:

'Docs Add-on Project Script ID'

and

'Docs Add-on script version'

In the first, I enter my script ID from my app's 'Project Settings' and in the second, I enter the 'Deployment ID' as above.

Clicking on 'Save', I get:

"Project Key is not associated with the current project or the script version doesn't exist."

Where have I gone wrong?

One further question: I'm apparently required to supply an 'Application card banner' – I can't find any explanation as to what that is. Any ideas?

Mark

[Alan Wells]

Do not use the Deployment ID for the 'Docs Add-on script version'.

That is the problem.

The 'Docs Add-on script version' field needs a number.

It seems that you are using the new code editor, and it also seems that the new code editor doesn't show the version number anywhere.

It shows the name that you gave to that version, but not the actual version number.

So, that's just one more thing on the list for how the new code editor has failed to reach parody with the old editor.

So, if anyone from Google tells you that the new code editor is at parody with the old code editor, then they are lying to us.

It's not surprising.

I guess the only way that you can see a list of your Apps Script project version numbers is to revert back to the legacy code editor

and use the File menu and choose "Manage Versions."

[Mark Grimshaw-Aagaard]

Thanks for the response Alan. I went back to the old editor and found a version number (4). I input this and got the same error . . .

But, then, I tried saving again (out of pure frustration) . . . and it worked!

Thanks!

Any advice on what an 'Application card banner' is?

Mark

[Alan Wells]

There is some info about the  Application card banner at:

https://developers.google.com/workspace/marketplace/create-listing#graphic_assets

All it gives for information is its size:

220 x 140 pixels.

What it is, is the graphic that is displayed in your Marketplace listing.

This is what people will see when they are looking for add-ons in the Marketplace.

[Mark Grimshaw-Aagaard]

Thanks. I've seen that page and the size so assumed it was some kind of icon. But no idea where it was placed or what it was used for.

Mark

[Alan Wells]

I gave that documentation page a thumbs down, which is the only way to send feedback.

In the feedback I asked for more information.