# Gmail Add-On Permissions, Explained Honestly

> That consent screen is asking a real question. Here's what Workspace add-on permissions actually mean, what to check about any vendor, and how to revoke access in one minute.

- Source: https://www.8apps.co/blog/gmail-addon-permissions-explained
- Markdown: https://www.8apps.co/blog/gmail-addon-permissions-explained.md
- Published: 2026-09-02
- Author: 8apps Team
- Language: en

---
## The consent screen is asking a fair question

Install any Gmail add-on and Google shows you a consent screen listing exactly what the add-on wants to do. Most people either click through without reading or close the tab in alarm. Both reactions skip the useful middle: the screen is answerable, and the answer takes about two minutes.

## What the scopes actually mean

Workspace add-ons request named permissions – scopes – and Google lists them on the consent screen before anything is granted. The distinctions that matter:

- **Read vs modify.** Reading your mail and changing your mail are different scopes. An extraction tool needs to read messages in the searches you run; it does not need to send mail as you or delete anything. If the consent screen asks for more action than the product's job requires, that mismatch is your signal.
- **Scoped to the job vs scoped to everything.** Some scopes cover only the message the add-on is currently open on; others cover the mailbox. A tool that works across a whole label genuinely needs the broader read scope – the question is not "is the scope broad" but "does the job explain the scope".
- **Where the code runs.** An Apps Script add-on runs on Google's infrastructure under your own account's authorisation – a materially different setup from a service that copies your mailbox to its own servers. The consent screen will not tell you this; the vendor's documentation should.

## Four questions to ask any vendor before granting access

1. **Does each requested scope map to a visible feature?** If you cannot name the feature a scope serves, ask the vendor – a good one has the answer written down.
2. **Where does the data go?** In-account processing, or copied out? If the privacy page does not say, that silence is the answer.
3. **What does Google know about them?** Marketplace listings show the developer identity; add-ons using sensitive Gmail scopes go through Google's app verification. Absence of verification is visible as an "unverified app" warning at consent time.
4. **Can you leave cleanly?** Uninstalling from the Marketplace plus revoking access (next section) should be the whole exit.

## Revoking access takes one minute

Go to your Google Account → Security → Third-party apps & services → See all connections ([myaccount.google.com/connections](https://myaccount.google.com/connections)), open the add-on, and remove its access. The grant dies immediately; the add-on keeps nothing it was going to read next. Do this ruthlessly for anything you no longer use – old grants are risk with no benefit.

## Where Contact Extractor stands

[Contact Extractor](/google-workspace/contact-extractor) is an Apps Script add-on that runs in your own Google account. It reads mail only within the search or label you point it at, and writes to a Google Sheet you own. The scopes it requests are the ones that job requires – and the two-minute check above is exactly the check we would want you to run on us.

## Sources

- [Google – Choose Gmail API scopes](https://developers.google.com/workspace/gmail/api/auth/scopes) – read 2026-09-02
- [Google Cloud – Verification requirements for sensitive and restricted scopes](https://support.google.com/cloud/answer/7454865) – read 2026-09-02
- [Google Account Help – Manage links between your Google Account & apps from other developers](https://support.google.com/accounts/answer/13533235) – read 2026-09-02