I’m attempting to read emails in a google group from a service account. This is what I’ve tried so far after looking at the documentation and examples, but I couldn’t find any examples of exactly what I’m attempting.

import fs from "fs";
import { JWT } from "google-auth-library";
import { google } from "googleapis";

const main = async () => {
  const keyFile = fs.readFileSync("./download-gmail-service.json");
  const key = JSON.parse(keyFile.toString());

  const client = new JWT({
    email: key.client_email,
    key: key.private_key,
    scopes: [
      "https://www.googleapis.com/auth/gmail.readonly",
      "https://www.googleapis.com/auth/admin.directory.group",
    ],
    subject: "[email protected]",
  });

  console.log("Authorizing client...");
  await client.authorize();
  console.log("Client authorized.");

  const gmail = google.gmail({ version: "v1", auth: client });
  const res = await gmail.users.messages.list({  // <---- Error from here
    userId: "[email protected]",
  });
  console.log("Loaded messages.");

  const messages = res.data.messages || [];

  for (const message of messages) {
    const msg = await gmail.users.messages.get({
      userId: "[email protected]",
      id: message.id!,
    });
    console.log(`Message snippet: ${msg.data.snippet}`);
  }
};

main()
  .then(() => process.exit(0))
  .catch((err) => {
    console.error(err);
    process.exit(1);
  });

The error I get from this version is:

error: Delegation denied for [email protected]
 errors: [
  {
    "message": "Delegation denied for [email protected]",
    "domain": "global",
    "reason": "forbidden"
  }
]
 code: "403"

I’ve tried a lot of different combinations of userId in these requests, but haven’t found anything that works yet.

• Domain-wide delegation is enabled
• [email protected] is a member of [email protected]
• The service account is also a member of [email protected]
• The service account has the Service Account Token Creator role for [email protected], [email protected], and itself.