Google API Authentication for App That Only Accesses One Account

Question

Should I use a Service Account or an OAuth 2.0 Client ID?

I'm struggling to understand Google's documentation on authenticating for their APIs. I'm creating a basic application that will help users add and modify Google Calendar events for a single Google account (the account is shared between all users). I only need the application to access that one account, it'll never need to access any others.

It seems to me that Service Account would be best for this, but Google's documentation suggests Service Accounts should only be used for automated processes (unless I'm misunderstanding). For instance this page contains the following, describing when to use Service Accounts.

Would my application qualify as acting on the users behalf?

If so, I would want to use OAuth Client ID credentials, which will ask the user to sign in to a google account. In this case, is there a way I can guarantee they only sign in to the one account I want modified?

I can't find any decent documentation on the OAuth authentication requests to figure this out myself. If there is any could you point me there?

I'm sure I'm misunderstanding something basic here, but thank you for any help!

Answer 1

First off you should know that you can only use service accounts with Google aclendar api if you have a google workspace domain account.

You can then set up a calendar and a domain user that the service account can act on behalf of to control the access of that calendar.

Assuming that your application is going to preform all actions on this calendar then yes i would say that you could use a service account for this. If your app bacly has a ui with a calendar on it your just using google calendar to store the data.

However if you intend to share this calendar with the users themselves, this way they could see it within their own google Calendar account. Im not sure a service account would be the way to go.

If you want the users to be able to see it and make changes then you may want to just use Oauth2. Grant them access to the calendar and then request access to their calendar account.

Drawback to that option is going to be the verification process. You will get access to all the users calendars and your going to need write access.

If you can go with a service account you really should consider it it will save you a lot of hassle with verification.