Google Services

How to Audit and Revoke Third-Party App Permissions on Your Google Account

Find and remove abandoned apps, games, and web extensions with access to your Gmail messages, Google Drive documents, contacts, and calendar.

Written by Alex Morgan (Senior Editorial Director & Tech Lead) Published: August 12, 2026 Updated: August 26, 2026 6 min read

Quick Summary & Key Takeaways

Objective: Find and remove abandoned apps, games, and web extensions with access to your Gmail messages, Google Drive documents, contacts, and calendar.
Estimated Time: Approximately 6 minutes following our step-by-step instructions.
Safety Recommendation: Ensure your device battery is above 30% and preserve any important files or passwords before modifying system settings.

Cybersecurity audit concept on computer interface showing access control switches — Inspecting and revoking third-party OAuth access tokens on Google Account.

Whenever you click "Sign in with Google" on a new productivity tool, online game, or mobile app, you grant that company specific API permissions (OAuth tokens) to access portions of your Google profile. Over several years, dozens of abandoned services retain background access to your email metadata, contact lists, or cloud files without your knowledge.

Auditing and revoking stale third-party permissions is one of the most effective ways to harden your Google Account security against data breaches and unauthorized scraping.

1. How to View All Connected Third-Party Apps

Open your browser and go to myaccount.google.com/connections (or navigate to Google Account > Security > Your connections to third-party apps & services).
Click See all connections to view the full inventory of connected platforms.
Review the categorized connection list:

Has access to: Apps with full or partial access to specific data (e.g., Google Drive, Calendar, Contacts).
Sign in with Google: Apps using Google purely as a federated identity provider.

2. Inspect Permission Scopes and Risk Levels

Click on individual applications to inspect their exact privileges:

Low Risk: Apps that only receive your Name, Email Address, and Profile Picture.
High Risk: Apps that request permission to "Read, compose, send, and permanently delete all your email from Gmail" or "See, edit, create, and delete all of your Google Drive files".

If you no longer use the software or do not recognize the developer, the token should be revoked immediately.

3. How to Revoke Third-Party App Access

In the connection detail pane, scroll down to the bottom.
Click Delete all connections you have with [App Name] (or Stop using Sign in with Google).
Confirm the deletion prompt.
Google will instantly invalidate the OAuth authentication token. The external company can no longer query your Google servers for new data.

4. Audit Chrome Browser Extensions Access

Certain Chrome extensions request elevated permissions to read page content and communicate with Google web apps:

In Google Chrome, click the Three Dots Menu > Extensions > Manage Extensions (or type chrome://extensions).
Remove any suspicious or outdated add-ons that have not received developer updates in over 12 months.

Frequently Asked Questions

Will revoking an app's Google connection delete my account on that service?

No. Revoking the Google connection cuts off the app's ability to access your Google profile and data. To completely delete your account with that specific service, you must log into their website directly and request account termination.

Can an app regain access automatically after being revoked?

No. The developer cannot reconnect without your explicit consent. If you open that app again, it will prompt you with an authorization screen asking for fresh permissions.

How often should I audit my connected third-party Google apps?

Security professionals recommend auditing your connected applications at least once every 6 months to remove abandoned services and prevent unauthorized data harvesting.

Will deleting an email with attachments in Gmail immediately free up Google Drive space?

Yes, but only after you navigate to Gmail Trash and click 'Empty Trash now'. Items left in Gmail Trash continue counting against your 15GB unified quota for 30 days until automated permanent deletion occurs.

Can Google Workspace administrators read my private emails or files?

Yes. In an organization or corporate Google Workspace account, domain administrators possess comprehensive Vault auditing tools and access privileges to export user emails, Drive documents, and revision logs.

What is the difference between a Google Passkey and a standard password?

A Passkey uses public-key cryptography where your device holds a private cryptographic key protected by biometrics (fingerprint or Face ID), while Google stores only the public key. Passkeys are completely immune to phishing websites because browsers verify domain signatures before unlocking credentials.

About the Author: Alex Morgan

Senior Editorial Director & Tech Lead

Alex is the Senior Technology Editor at AkTricky with over 10 years of experience diagnosing mobile operating systems, iOS features, and hardware issues. He specializes in practical everyday consumer technology.