title: Google OAuth2 API Separate Tokens by Subdomain
body: <p>I have a multi-tenanted app that I need to integrate with a Google API endpoint, lets say the Calendar API.</p>
  
  <p>The application is organized much like Slack. You can create a namespace and invite users to it. The subdomain is used to separate namespaces, so there could be: <code>foo.domain.com</code>, <code>bar.domain.com</code>, and <code>baz.domain.com</code>.</p>
  
  <p>A user, can belong to multiple namespaces, much like in slack where you can belong to different teams. So <code>John</code> can be a member of both <code>foo</code> and <code>bar</code>.</p>
  
  <p>The problem is, when <code>John</code> decides he wants to give <code>foo</code> access to his calendar info, Google links the authorization to <code>domain.com</code> rather than <code>foo.domain.com</code>. When I attempt to give access his calendar to <code>bar</code> as well, there is no refresh token because technically <code>John</code> has already authorized the access... but I would like these to be treated independent. So that <code>John</code> is able to revoke access to <code>foo.domain.com</code> but continue to have <code>bar.domain.com</code> access his calendar data.</p>
  
  <p>Is there a way to create independent authorizations for the same user to the same app? I can't share the <code>refresh_token</code> across subdomains as they may be physically separated, and I can't create a different app for each subdomain as they are dynamically generated.</p>