I have a Google Apps Script project that I want to deploy as a web app. This web app is supposed to be called from an external c# web site, for internal/company use only. Basically a server-to-server call.

In this c# website, I already am calling Google Drive and Sheets API using a service account I created in Google Cloud console.

My problem is that in order for me to call the web app I created from this c# website, I need to deploy it with Who has access set to ‘Anyone’.

This of course is a security issue because the web app functions can be executed by anyone who has the link.

I’ve been doing a lot of research and experimenting and still have not figured out how to make the web app secure, with using a service account to call it.

I’ve even asked Gemini and it has been persistent that I can use OAuth2 with grant type = ‘client_credential’. I never got this to work, or I’m implementing it incorrectly.

This requirement is not unique in my case, and I assume there are already some if not a lot of systems out there with this implementation.

So the question is:
How do I make a Google Apps Scripts web app, that is not available publicly but can be called securely from an external website without OAuth2 (or using OAuth2 without the user interaction)?

Thanks in advance!