Gmail API returns 403 error code and “Delegation denied for <user email> about python-samples HOT 1 CLOSED

The gmail docs are a little sparse here, but the guide for managing delegates links to https://developers.google.com/identity/protocols/OAuth2ServiceAccount#delegatingauthority which explains what you need to do to get this to work.

From the code, it looks like you're using the web/installed app end-user flows for oauth, and just authorizing with an admin account. That produces a token to access the admin's gmail account, but the fact that the user is an admin doesn't grant it any additional privileges.

Instead, you need to create a service account and grant it access to impersonate users on the domain in order to do what you're trying to do.

I know it's a bit weird to jump through the extra hoops, but the extra restrictions are in place to prevent abuse of delegation/forwarding rules by malicious apps since they persist independent of the OAuth authorization.

from python-samples.