"Allow this application to run when you are not present" in Google Apps Script

Question

Why is my add-on asking for this permission? Tried looking through the docs and couldn't find anything.

As far as I know, my application doesn't run when the user isn't present! (It requires the user to select a range in Google Sheets, press a button in custom UI, and call an external API). Are there any tips for what I should look for to find the offending code or configuration that's triggering such a permission request?

Answer 1

How about this answer?

1. Quick confirming

Allow this application to run when you are not present

When above authorization message is displayed, it means that the methods which use the scope of https://www.googleapis.com/auth/script.scriptapp is used in the project. You can see the scope in the project at File -> Project properties -> Scopes. The methods which need such scope are in especially ScriptApp. When getProjectTriggers(), getUserTriggers(), deleteTrigger(), newTrigger() are used in the project, such scope is automatically detected. If you have already noticed that such methods are used in your project, this section might be an answer.

2. Investigating

If you have already noticed that such methods are NOT used in your project, please check this section.

When the GAS project is saved, the scopes which are used in the project are detected by the automatic detection. This automatic detection also works for commented out methods. Furthermore, even when each word is separated, the word is detected, because the automatic detection works for the special words, as follows.

ScriptApp.getOAuthToken()

// .... do something

// newTrigger  <--- this is put as a comment

When above script is in the project, the automatic detection says that https://www.googleapis.com/auth/script.scriptapp is required. But in this sample, ScriptApp.getOAuthToken() doesn't require https://www.googleapis.com/auth/script.scriptapp.

If you want to confirm whether the authorization which uses such scope is required to run your script, you can do it using "Manifests". Recently, "Manifests" was added to GAS project. Using "Manifests", the automatic detection of scopes can be stopped. By this, you can know whether the detected scopes are actually required to the project. In order to confirm this, please do the following flow.

1. On the script editor.
2. File -> Project properties -> Scopes
3. Copy current scopes.
4. View -> Show Manifest file
   • appsscript.json appears.
5. Please add the copied scopes to appsscript.json as follows.

The default appsscript.json is

{
  "timeZone": "### your timezone ###",
  "dependencies": {
  },
  "exceptionLogging": "STACKDRIVER"
}

For this, please add the copied scopes as follows. And please save this.

{
  "timeZone": "### your timezone ###",
  "dependencies": {
  },
  "exceptionLogging": "STACKDRIVER",
  "oauthScopes": [
    "https://www.googleapis.com/auth/script.scriptapp",
    "scope2",
    "scope3",
    ...
  ]
}

After added oauthScopes, at first, please confirm whether your script works fine. And then, remove https://www.googleapis.com/auth/script.scriptapp from oauthScopes, and run again. At this time, if there is an error, it is indicated that the errored line uses the scope of https://www.googleapis.com/auth/script.scriptapp.

Note :

• Also there is a possibility that the authorization Allow this application to run when you are not present is not related to https://www.googleapis.com/auth/script.scriptapp.
  • When you see the scopes in your project, if https://www.googleapis.com/auth/script.scriptapp is not included, after added the scopes to appsscript.json, please confirm the error line by removing scopes one by one.

References :

• ScriptApp
• Manifests

If this was not useful for you, I'm sorry.

Answer 2

I had this problem with my add-on, and realised the script.scriptapp scope was being automatically detected because I had implemented the onOpen and onInstall methods (to install the add-on menu items).

If you want to see the scopes detected for your google app scripts, in the Script Editor, select Project Properties and then the Scopes tab.

This code is directly from the Google Add-on's tutorial - and it's a pity it causes such a scary looking permission request.

/**
 * Creates a menu entry in the Google Docs UI when the document is opened.
 * This method is only used by the regular add-on, and is never called by
 * the mobile add-on version.
 *
 * @param {object} e The event parameter for a simple onOpen trggr. To
 *     determine which authorization mode (ScriptApp.AuthMode) the trggr is
 *     running in, inspect e.authMode.
 */
function onOpen(e) {
  DocumentApp.getUi().createAddonMenu()
      .addItem('Start', 'showSidebar')
      .addToUi();
}


/**
 * Runs when the add-on is installed.
 * This method is only used by the regular add-on, and is never called by
 * the mobile add-on version.
 *
 * @param {object} e The event parameter for a simple onInstall trggr. To
 *     determine which authorization mode (ScriptApp.AuthMode) the trggr is
 *     running in, inspect e.authMode. (In practice, onInstall trggrs always
 *     run in AuthMode.FULL, but onOpen may be AuthMode.LIMITED or
 *     AuthMode.NONE.)
 */
function onInstall(e) {
  onOpen(e);
}