What are apps named "project-" plus 12-digits?

[VicGanon]

In the Security > API Controls > App Access Control where one can see the lists for configured and accessed apps, there are app names that has the word "project-" and followed by 12 digits. It seems that some are for legit apps, others are quite unclear, but others have Google Play blurbs about casinos. 

What are these "apps" and should they all be blocked for the whole domain?

[Kim_Nilsson]

They are for simple Apps Script solutions people have created in one of Google's apps, usually Sheets.

[VicGanon]

Here is an example and I do not know why casinos are mentioned in the Google Play blurb. And there are a lot of "project-" apps that should be reviewed.

[Kim_Nilsson · Accepted solution]

This is very common and not the least strange.

This is an app that some user has logged into using the Login with Google button. As there are 100s of millions of apps, using Google login, there will be many such examples.

This is absolutely not something you should allow.

That's also why the proper process should be to go through the list of accessed apps and only Trust the very few apps that you know everyone should have access to, and then set the default setting to Block everything.

Everything else that people need you will quickly learn about, as people will immediately be blocked from accessing them, and will reach out to tell you about it. Preferably, they should reach out through an already existing process for "request access to new apps, services or extensions", where you can properly vet them before allowing, or denying access.

[VicGanon]

This seems the most practical solution. Thanks!