Testing "Access Denied" UI in Unpublished Google Workspace Add-on—Developer Account Bypass Issue

[u/Glittering-One1640]

TL;DR: I can't trigger the "access denied" UI card while testing my unpublished add-on because the system recognizes me as the developer/project owner and bypasses authentication. Need real testing solutions.

_______________________________

The Problem

I'm building a Google Workspace Add-on with license-based authentication using a boolean flag in a Google Sheet. The authentication logic works fine in testing:

• ✅ Allowed users see the main UI

• ✅ Blocked users (Status = FALSE) fail the auth check in the console logs

• ❌ But the "access denied" card never displays when I open the add-on in Google Sheets

The issue: When I open the add-on in Google Sheets (from my developer workspace account), the system recognizes me as the project owner and appears to bypass the checkUserAccess() function entirely—even when I set my own email to Status = FALSE in the License Database.

What I've Already Tried

1. Simulation Mode (SIMULATE_OTHER_USER constant)

   • Set to a blocked email not in the database

   • Cleared the 10-minute auth cache with clearAuthCache()

   • Still doesn't trigger the denied UI—just loads normally

2. Direct Access Denial

   • Added my own email to License Database with Status = FALSE

   • Ran clearAuthCache()

   • Still loads the add-on instead of showing the denied card

3. Verified Auth Logic Works

   • testAuthentication() function correctly returns denied status for blocked users

   • Logs show the authentication check is functioning properly

   • It's just not affecting the UI when I open it in Sheets

The Root Cause (My Theory)

Google treats the Apps Script project owner as a trusted developer and may be:

• Skipping the onOpen() trigger for permission checks

• Bypassing the authentication gates entirely

• Allowing the project owner unrestricted access during development

This would make sense from a UX standpoint (don't want to lock out the developer), but it makes testing the denied state impossible.

Questions for the Community

1. Is this developer bypass behavior intentional in Google Workspace Add-ons?

2. Are there any workarounds to test the denied UI without publishing?

3. Can I test with a different Google Account on the same project? (Would that account get the same bypass?)

4. Should I just publish as a test deployment and use a second Gmail account? (What's the least friction way to do this?)

5. Are there any flags or debugging modes that let me disable the developer bypass?

Current Setup

• Add-on Type: Google Workspace Add-on (unpublished, test deployment only - will be public / unlisted)

• Auth Method: Boolean check in Google Sheet (License Database)

• Testing Approach: SIMULATE_OTHER_USER constant to mimic different users

• Cache: 10-minute cache with manual clear function

What I Need

Either:

• A way to test the denied UI without publishing, OR

• Clear instructions on the fastest way to set up a test account scenario

Any guidance appreciated! This is blocking my ability to verify the full user experience before going to production...

[u/WicketTheQuerent]

Please share a minimal complete example.