title: What is the best way for us to fetch GMails after domain wide access has been granted to our app?
body: <p>We are building an App on Google Apps Marketplace which sits on top of GMail and reads customer email to provide analytics on top of it. From what I understood of the documentation:</p>
  
  <ol>
  <li>When the IT admin of the customer account installs my app, my app asks for the required permissions, which is then granted to the OU/Org.</li>
  <li>Now I have 2 situations:
  <ul>
  <li>a. User does a Google+ Sign In to access emails from my website</li>
  <li>b. Our service works in the background to run analytics and delivers notifications/reports as and when necessary.</li>
  </ul></li>
  </ol>
  
  <p>I'd like to be able to do this without asking each individual user again for permissions. What is the method for fetching the emails for a particular customer domain for all their users? If I follow the normal "server auth" flow, I need a refresh token for which I need access_type=offline which prompts a grant request always, and if I use service account, I'm getting a HTTP 500 "Backend Error" on my App Engine local dev server.</p>
  
  <p>Before I invest time going down any path, I'd like to ascertain what the best practices are. The GMail API documentation talks about service objects but makes no mention of Service Accounts or things like AppAssertionCredentials.</p>