On Google Workspace, I have created an email that I only need to check programmatically.
For that, I'm going to use Push Notifications but I'm not really sure about the authentication part. Apparently, the only way for a service account to access (impersonate) a user's mailbox would be via domain-wide delegation, something Google doesn't recommend if there's another way.
Avoid using domain-wide delegation if you can accomplish your task directly with a service account or by using the OAuth consent flow.
My question: what other ways are there?
- Is it technically possible for a service account to impersonate a single user?
- Regarding the OAuth consent flow, how could I make it work (how would the user consent in this case) considering this would be server to server communication?