I have set up the application to report multiple campaigns from multiple clients (grouped by particular client). For testing, my client provided an access to my application (I followed this tutorial https://developers.google.com/analytics/devguides/config/mgmt/v3/quickstart/service-php#add-user). Everything was OK until now. My client brought up requirement that most of his clients provided him only a limited access and he just can't grand the access for my developer app. Is it possible to make my app able to report with only login and password to read-only account without an admin privileges?
Yes, For the Core Reporting API and the Analytics Reporting API V4 You can add the service account email address to any level:
with only read-only access.
The only required scope is:
https://www.googleapis.com/auth/analytics.readonly
See the help center article for details on how to add user to an account.
If your application needs to use write operations in the Analytics Management API V3, then there may be need for more scopes.
Alternative scenarios are this, You could write a web App where the final user of your application authiticates and authorizes your app to retrieve the data. Service accounts are really useful when you need to have a single server processing data from very few Analytics Accounts. But if you intend on many users accessing their own data then you should look at some of the alternative scenarios.