u/Confident_Meat2189

I have a Google Sheets document with custom App scripts that create custom menus to create forms to enter data. I share the document with one other Google user who I have given Editor access. When they try to execute the custom menu items get get a popup:

"Authorisation required A script attached to this document needs your permission to run."

When they click OK they get another popup:

"This app is blocked This app tried to access sensitive info in your Google Account. To keep your account safe, Google blocked this access."

And they can't go any further. How can I resolve this issue?

I couple of weeks ago I posted that I look after a not-for-profit 'hobbyist' educational website with very little/no regular income that is being hammered.

A lot of people on here mentioned the free Cloudflare level which I signed up for. This definitely helped controlling AI bots.

However this morning I got this message from the webhosts:

"Yesterday, your site was accessed from 486,109 different IP addresses; over the past week it's been nearly 2.5 million.  Many of these are only used a handful of times then discarded."

Is there any way of managing this through Cloudflare?

UPDATED
Thanks for all the responses. They have given me a lot to look at. In terms of the page requests looking at the logs a lot of them appear to be long fabricated junk urls made up of parts of genuine urls. So:

Genuine url: root/a/b/c

Fabricated url: root/a/c/b/b/a/c/a/c/c