document required scopes for gmailctl about gmailctl HOT 2 CLOSED

Thanks, I missed that part. Note that however, independently on how you created the project, gmailctl specifically scopes the API to the minimal permissions. See pkg/api/auth.go. Limiting this also at the project level seems like a good idea anyway.

from gmailctl.

In my case it came from the discovery that the recommended "user data" wizard version included a scope in the project auth page that ran into a security policy that'd require review, while these settings only are fine without.

I'm not sure this'll be an issue for anyone outside large organizations with strict security policies, but even for the average "home" user it means that a leaked token is only able to be used for these changes, while the wizard version could be used to read all email content, or mutate it.

So ... protects users against their own mistakes, basically.

from gmailctl.