Using Google Oauth2, the following scope is used to get API-access to a users email: https://mail.google.com/
Testing the scope via OAuth 2.0 Playground confirms that the app wants to "View and manage your email":
Is there a way to only ask for access to send emails on behalf of the user? A more specific scope perhaps?
I am afraid that the answer is no. The GMail API documentation specifies a single scope (https://mail.google.com) providing both read and write access. Not ideal IMO, would be nice to have independent read/write email access scopes.
FYI, a similar question in SO leads to the same conclusion for read-only email access.