Google app engine imap invalid credentials - google-app-engine

Question

I'm trying to get the emails of my users. I have a service account setup and an access token from the client library. I enter these details in to the xoauth library found here https://developers.google.com/gmail/xoauth2_libraries. But I keep getting invalid credentials errors. One account works and its the admin/impersonated account but no others work. This is a php app can someone please help.
$client = new Google_Client();
$client -> setApplicationName("TTS Dashboard");
$client -> setClientId(CLIENTID);
$client -> setClientSecret(CLIENTSECRET);
$oauth2 = new Google_Service_Oauth2($client);
$directoryService = new Google_Service_Directory($client);
$driveService = new Google_Service_Drive($client);
$calendarService = new Google_Service_Calendar($client);
if (isset($_SESSION['service_token'])) {
$client -> setAccessToken($_SESSION['service_token']);
}
$path = 'http://' . $_SERVER['HTTP_HOST'] . "/static/" . KEYFILEPATH;
$key = file_get_contents($path);
$cred = new Google_Auth_AssertionCredentials(SERVICEACCOUNTEMAIL, $scopes, $key);
$cred -> sub = $impersonatedEmailAddress;
$client -> setAssertionCredentials($cred);
$client -> getAuth() -> refreshTokenWithAssertion($cred);
if ($client -> getAuth() -> isAccessTokenExpired()) {
$client -> getAuth() -> refreshTokenWithAssertion($cred);
}
$_SESSION['service_token'] = $client -> getAccessToken();
function GetAccessTokenString() {
$accessToken = $_SESSION['service_token'];
$token = json_decode($accessToken, true);
$tokenString = $token['access_token'];
return $tokenString;
}
// Get access token string value
$tokenString = GetAccessTokenString();
tryImapLogin($studentEmail, $tokenString);

Answer 1

With service accounts and domain-wide delegation, you need to create one access token for each user, that is you need to impersonate each user, one after the other.
The admin access token will not give you access to other user's mailboxes.