Our app has a requirement to access to all Gmail mailboxes pertaining to a Gsuite account. I am able accomplish this, by following the instructions at https://developers.google.com/admin-sdk/reports/v1/guides/delegation. i.e. manually creating a service account key, enabling domain wide delegation on the credential and assigning appropriate permissions manually in the G Suite Admin area. This appears to work when manually setting it up for each our clients, however, the process is complex and cumbersome and is a barrier to adoption.
In attempt to implement a one click signup process, as per the requirement for G Suite marketplace, I create an OAuth client ID (as opposed to service account) and use this credential to redirect the user through consent process as part of the signup process. Thereafter, use the refresh/access credential to access the G Suite API's. This works wonderfully, except I am only able to access the mailbox of the logged in user (not anyone else in the domain). Domain wide delegation does not appear to be available with a client ID credential.
I do realize that service account credentials have a client ID, but they do not allow the ability to specify acceptable redirect URI's. Therefore, consent process seems impossible to implement using a service account.
My app is registered with the Chrome store. How can one create a credential, use consent process to accept permissions, and still have the benefit of domain-wide delegation?
