Summary
📝 Note
📚 Pilotflow Series: Building a Gmail Addon
- The $50,000 Lie That Almost Killed My Gmail Addon ← you are here
- Gmail OAuth Scope Tiers Decoded — June 15
- Pre-Development Codebase Analysis — June 22
- Legal Documents for Gmail Addons — June 29
Fifty thousand dollars. That’s the number that nearly made me close my laptop and shelve Pilotflow before writing a line of code: a certification fee, for a free tool, before I’d made a single dollar from it.
I was planning a Gmail addon meant to help users reclaim their inbox, and the core feature meant reading email threads well enough to act on them. So I went looking for what a Gmail addon actually requires from Google Workspace Marketplace. A forum post said CASA Tier 2, $50,000 to $75,000. Then another forum post said the same thing. Then a Stack Overflow answer agreed. Three independent sources converging on one number is normally how you know a number is true. Here, it just meant the myth had spread far enough to look like consensus.
The Myth That Circulates in Developer Communities
The figure is everywhere: 2022 blog posts, forum threads, indie hacker discussions, all citing each other in a loop nobody seems to have broken. It’s not fabricated. That price is real for CASA Tier 2 certification, under one specific assessment path. What none of those posts mention is that it’s the ceiling of a range, and most Gmail addons never touch that ceiling.
CASA (Cloud Application Security Assessment) is Google’s framework for vetting apps that request restricted OAuth scopes, the ones with the most invasive access. Google doesn’t run it directly; authorized third-party firms called CASA TAPs (Third-party Assessment Providers) do, testing your app against the OWASP Application Security Verification Standard. Pass, and you get a certification letter that clears you to publish with restricted scopes. What the forums describe as “the CASA price” is the top tier of that process: penetration testing, manual code review, extended vulnerability analysis. It’s the most thorough option, and also the most expensive. That’s exactly why it’s the one that gets repeated.
The Real Numbers I Found
I called two CASA TAPs directly and read Google’s own program documentation instead of the fifth forum thread. The range looked nothing like the myth:
| Assessment path | Approximate cost | What it covers |
|---|---|---|
| Self-assessment (with TAP review) | $540–$900 | OWASP ASVS checklist, TAP validates your work |
| Standard TAP assessment | $900–$1,800/year | TAP reviews app, no full pentest |
| Full penetration testing assessment | $15,000–$75,000+ | Complete manual testing, code audit |
The $50K–$75K figure describes full penetration testing, the option built for enterprise integrations touching financial data, not an indie Gmail addon at MVP stage. For Pilotflow, the standard TAP path was the right fit: $900–$1,800 a year, proportional to the actual risk of a solo-built tool, not the risk profile the forums assumed by default.
But Here’s the Question That Mattered More
Knowing the real price was a relief. It also raised a better question than “how much does CASA cost”: did I need a restricted scope at all?
I’d been planning to use gmail.readonly: full read access to the entire inbox, which is exactly why it’s classified restricted and exactly why it triggers CASA. But Pilotflow doesn’t need an inbox analytics platform’s worth of access. It needs to act on the specific thread a user is currently looking at. Google has a scope for precisely that: gmail.addons.current.message.readonly. Sensitive, not restricted. OAuth verification only, free, four to six weeks, no CASA at all.
gmail.readonly→ entire inbox → restricted → CASA certification requiredgmail.addons.current.message.readonly→ currently open message → sensitive → OAuth verification only
The feature I actually wanted to ship needed the narrower scope. The broader one was access I’d imagined wanting, not access the product required, and that gap between imagined and required is where most certification budgets get wasted.
The Decision That Saved the Project
I redesigned Pilotflow around current-message context instead of full-inbox access. That meant the MVP works inside the thread a user has open right now; anyone who wants batch processing triggers it explicitly, on demand; and there’s no background inbox access, no restricted scope, no CASA bill at launch.
Notiwise, the calendar addon I’d built before Pilotflow, had already hit the same fork in the road. Building a notification feature, the team found that gmail.addons.current.message.readonly would trigger CASA while calendar.addons.current.event.read wouldn’t, and redesigned around the cheaper scope without losing the user-facing feature. Same pattern, second project, same fix.
What I’d Tell Someone Starting This Research
If you’ve hit the $50,000 number and it’s making you reconsider the whole project:
- Check the scope classification first. Google’s OAuth documentation marks every scope public, sensitive, or restricted, and only restricted triggers CASA.
- Design for the minimum scope the actual user workflow needs, not the scope that would be convenient to have later.
- If restricted really is unavoidable, get real quotes from two or three TAPs before assuming the ceiling price applies to you.
- Budget for it honestly: at $900–$1,800/year, you need roughly $75–$150/month in revenue just to cover certification. Know that number before you build, not after.
The number that nearly killed this project was never the real cost. It was the cost of not questioning a number three strangers on the internet happened to agree on.
The next post in this series covers Gmail OAuth scope tiers in detail: the three-tier classification system and how scope choice shapes both the certification bill and what your user sees at the consent screen.
