Scope reference for domain-wide delegation

Scopes are the entire security model here. The grant is a pairing of one client ID with an exact list of these strings — so the list you choose is the blast radius you accept.

Choose narrow, and choose once. Every scope you authorize applies to every user in the domain, silently. Adding one later means editing the grant in every tenant, so it is worth thinking through the full list before the first grant rather than bolting scopes on as features ship.

Gmail

mail.google.com is full access and supersedes the granular ones. Prefer the narrow scopes unless you genuinely need everything.

Scope	Grants
`https://www.googleapis.com/auth/gmail.readonly`	Read mail and settings. No send, no modify.
`https://www.googleapis.com/auth/gmail.send`	Send only. Cannot read the mailbox.
`https://www.googleapis.com/auth/gmail.compose`	Create and manage drafts.
`https://www.googleapis.com/auth/gmail.modify`	Read, modify, label. No permanent delete.
`https://www.googleapis.com/auth/gmail.settings.basic`	Signatures, filters, forwarding, send-as.
`https://mail.google.com/`	Everything, including permanent delete.

Drive

drive.file only sees files your app created — a frequent surprise when a script cannot find an existing document.

Scope	Grants
`https://www.googleapis.com/auth/drive`	Full access to the impersonated user's Drive.
`https://www.googleapis.com/auth/drive.readonly`	Read everything they can see.
`https://www.googleapis.com/auth/drive.file`	Only files created or opened by your app.

Calendar, Sheets, Docs

Straightforward. Read-only variants exist for each and are usually enough for reporting.

Scope	Grants
`https://www.googleapis.com/auth/calendar`	Full calendar access.
`https://www.googleapis.com/auth/calendar.readonly`	Read events and calendars.
`https://www.googleapis.com/auth/spreadsheets`	Read and write Sheets.
`https://www.googleapis.com/auth/documents`	Read and write Docs.

Admin SDK — the ones people forget

Directory scopes are authorized separately and are the most common cause of a delegation that 'suddenly' stops working when new code lands.

Scope	Grants
`https://www.googleapis.com/auth/admin.directory.user`	Create, read, update users.
`https://www.googleapis.com/auth/admin.directory.user.readonly`	Read the user directory.
`https://www.googleapis.com/auth/admin.directory.user.security`	List and revoke a user's OAuth app tokens.
`https://www.googleapis.com/auth/admin.directory.group`	Manage groups and membership.
`https://www.googleapis.com/auth/admin.reports.audit.readonly`	Read audit and usage reports.

Three traps

Read-only is not a subset at grant time

Authorizing drive does not authorize drive.readonly as far as the grant is concerned. If your code requests the read-only string, that exact string must be in the list.

Trailing characters matter

https://mail.google.com/ carries a trailing slash. Copy scopes; do not retype them.

Requesting more than you need fails louder than you expect

Because one unauthorized scope rejects the whole token request, a hopeful extra scope in your code breaks APIs that were working fine. Request exactly what the job needs.

Not sure which scopes your project needs?

Getting the list right the first time avoids re-opening the Admin console in every tenant later. We plan and implement scope sets as part of setup — $500 per hour.

Plan your scope list