Do I need gmail.send for the reply desk?

No. The desk drafts in the thread; a person sends from Gmail. gmail.send is added only for approved campaign sending.

Can the service account read every mailbox?

Only mailboxes in the organisational unit the delegation covers, and only those the code impersonates. Name the shared mailboxes and leave personal ones out.

Why does it work in testing but not production?

Different client IDs. Each service account has its own client ID and its own delegation entry; the production one needs the same scope list.

Does SPF or DKIM affect this?

No. Those affect delivery of outbound mail, not API authorisation. Set them anyway before the first campaign.

Fix · Sales

Gmail API: "Request had insufficient authentication scopes".

Calls to users.messages.list or users.drafts.create return 403 "Request had insufficient authentication scopes" for a service account that impersonates a mailbox.

Cause.

With domain-wide delegation, the scopes the code requests must match, string for string, the scopes the Workspace admin entered for that client ID in the Admin console. A trailing slash, a readonly variant or a missing gmail.modify breaks the match. The token is issued, but for the admin’s list, not the code’s.

Fix.

01	In the Admin console, open Security, API controls, Domain-wide delegation and copy the exact scope list for the service account’s client ID.
02	Compare it with the scopes the code requests; they must be identical sets.
03	Add gmail.readonly, gmail.modify and, for approved outbound, gmail.send to both; remove any scope the agent does not use.
04	Wait a few minutes for propagation, then request a fresh token; cached tokens carry the old scopes.
05	Confirm the mailbox being impersonated is inside the organisational unit the delegation covers.

How the build avoids it.

KYN records the delegation scope list in the runbook and the code reads scopes from the same list, so the two cannot drift.

Gmail integration →Reply desk →Every sales article →

Checked 13 October 2026 against a live build. Vendors change behaviour; if a step no longer matches, tell us and the page changes.

Questions operators ask

Do I need gmail.send for the reply desk?: No. The desk drafts in the thread; a person sends from Gmail. gmail.send is added only for approved campaign sending.
Can the service account read every mailbox?: Only mailboxes in the organisational unit the delegation covers, and only those the code impersonates. Name the shared mailboxes and leave personal ones out.
Why does it work in testing but not production?: Different client IDs. Each service account has its own client ID and its own delegation entry; the production one needs the same scope list.
Does SPF or DKIM affect this?: No. Those affect delivery of outbound mail, not API authorisation. Set them anyway before the first campaign.