Every group runs through these steps on its own Google account. There is no shared central project that all groups plug into — each group creates its own Google Cloud project, its own OAuth client, and its own dedicated service Gmail account(s) for the role mailboxes. The steps below describe one group's setup; another group repeats the whole thing independently.
This is deliberate, and it saves real money. Reading the contents of a Gmail mailbox uses what Google calls a restricted scope. For an app that's published to the public, Google requires a third-party security audit called CASA before it will allow that scope — roughly £400–£1,200, repeated every year or two. We avoid that entirely, and the way we avoid it is precisely because each group is self-contained:
Each group's OAuth client stays in "Testing" mode (never "published for general distribution").
It only ever connects to service Gmail accounts the group itself owns (for example a purpose-made yourgroup-membership@gmail.com), never a committee member's personal Gmail.
Google assesses CASA per OAuth client. Because each group's client is its own little self-contained setup — one owner authorising their own service mailboxes, never published — the audit requirement simply never triggers. If we instead ran one central client that lots of different people connected their personal Gmail accounts to, that would trip the requirement and we'd be back to paying for verification.
The one-time "unverified app" warning is normal. The first time you authorise, Google shows a screen saying it hasn't verified the app, with an "Advanced → continue (unsafe)" link. That's expected for a self-use setup like this — continue past it.
Use a dedicated Gmail account, not your personal one. Create a fresh Gmail address for each role mailbox and connect that. Keeping personal mailboxes out of it is what keeps the setup simple and free.
Yes, it's a lot of steps. Repeating the full Google setup per group is the trade-off for never paying for verification. It's the right call for a handful of groups; if this ever rolled out to hundreds, the setup would need rethinking.