Re: OAuth clients claimed to be inactive but not

swarren

I received an email which says:

As we recently announced , starting June 2025, OAuth clients that have remained inactive for six months will be automatically deleted. This change helps prevent credential theft and misuse.

Impacted OAuth clients

The following projects that you manage have one or more OAuth clients that have been inactive for at least five months. They will be deleted unless you take action:

However, the client in question is very much active. Every night I run a cron job that uses credentials associated with that OAuth client. It's not a new user registration, but the code definitely uses the refresh token each night to get a new token to call Google Drive APIs. I've looked at the credential storage for this app and the data it downloads, and confirmed that it's actually working correctly each night, and making active use of the refresh tokens.

Can anyone tell me why Google thinks that app/OAuth-client isn't active?

billnye

I just got the same email, definitely need Google to respond to this. They messed up bad with this email, the oauth client is used every day

Ericchiu

we get the same mail...

daniross

I received the same email today, and my app is active in production using OAuth keys almost every day. I can't understand why Google sent this email. I noticed that my API usage statistics data also seems to be missing data. Why?

jyrkive

I have the same issue. I asked Gemini for help and concluded after some troubleshooting that my app is clearly updating both access and refresh tokens as it should. Gemini told me to check the FileDataStore, and it has last been modified yesterday, meaning that the Google auth library is successfully interacting with the stored tokens. The app is active, somehow Google just doesn't realize it.

ExtDeveloper

I received the same email; I'm fairly certain that all the clients listed in the email have many active users.

smartermarks

Having the same issue. I have a critical client ID that has been used for hundreds of logins a day for years, and have confirmed successful token exchanges for those logins (returning a valid ID token) this morning, and it's listed as inactive and scheduled for deletion in their email. Happy to provide additional data as needed -- will be watching this thread closely.

jaredm

Also received this email with highly active (1000s of logins daily) client IDs listed.

jaredm

This is extremely urgent, can we get an official reply here from Google?

smartermarks

Just wanted to share something here that got posted to another of these threads, in case somebody else is panicking a bit (like me). From this Reddit thread, Google have now added a "last used date" under the creation date in "Additional information" in the clients page. As I'm sure many suspected, a lot of these emails were sent out in error, and the last used date is apparently a reliable way to check that your clients will not be deleted.

jaredm

Thank you for sharing! It seems like the "Last used at" date is still not quite accurate, but it does show my clients are not going to be deleted.

jaredm

Going to reply to myself here with a couple of other relevant reddit threads:

https://www.reddit.com/r/googlecloud/comments/1ky7aff/automatic_deletion_of_unused_oauth_clients/

https://www.reddit.com/r/googlecloud/comments/1ky4gs4/action_advised_manage_your_unused_oauth_client...

Seems like the lesson here is go to reddit for Google support.

swarren

Yes, my last used date says May 23, although every day including today (May 30) the refresh token was used. At least the date is pretty recent though.

swarren

BTW, the "last used date" only shows up when viewing on a desktop browser or large screen. It wasn't present when I viewed my client details from a mobile phone, even when I switched the browser to desktop mode.

urbanostpl

On June 2, I received an email from Google Developer stating that the previous email was sent in error. However, among the OAuth accounts we manage, there are accounts that received the notification email and those that did not. Is it correct to assume that the OAuth accounts which did not receive the email are still considered inactive for the past five months?

Please also confirm whether everyone has received the email or not.

swarren

I received the same email. However even that is wrong; it started that "All of your clients are in use, and no action is required at this time." which also isn't true; I definitely have a mix of active and inactive clients in my project list...

tmontour

On June 2, I received a follow-up email from Google Developers stating that a previous message sent on May 28 regarding "[Action Advised] Manage your unused OAuth clients and protect your information" was sent in error.

However, after reviewing the original message and the follow-up, I’m still seeing some of my OAuth clients flagged as inactive — including one that is actively used every few minutes for posting, pulling reviews, and accessing insights. These clients regularly refresh tokens and maintain usage, so I'm confused as to why they're being listed as inactive.

The follow-up email clarifies that some developers may have received incorrect information due to an issue with the recipient list, and that OAuth clients not inactive for at least five months should not be affected.

Appreciate any clarification or official confirmation from the team.