Google API's Service Account Client Authorization Server-to-Server (Offline Impersonate) Errors
<p>@note The involved server flow uses google-api-php-client-beta</p>

<p>The goal is to 'insert' an email 'message' into a Google for Work gmail account addressed to a registered email alias.</p>

<p>For this OAuth workflow, I have:</p>

<ul>
<li>a Google for Work User with an email alias on a registered add-on domain</li>
<li>created a 'Project' in console.developers.google.com/apis/</li>
<li>created a 'Service Account' under the Project</li>
<li>enabled the Account for 'domain-wide-access'</li>
<li>added an OAuth 'Client' to the Service Account, along with credentials downloaded as a JSON string</li>
<li>authorized the Client with 'scopes' in <a href="https://admin.google.com/my-domain.tld" rel="nofollow">https://admin.google.com/my-domain.tld</a></li>
<li>an authorization code allowing the 'Project' to request 'Access Tokens' to do scopes on the User (requires separate single-use client)</li>
</ul>

<p>The following server code attempts to acquire a Google_Client authorized with the above Credentials and Access Token, while asking for the OAuth Client to impersonate the GFW User mentioned. Thereafter the $client can be used to call services such as Google_Service_Gmail.</p>

<p>Currently, the <code>$authCreds</code> is returned with <em>['error_description'] => 'Could not determine client ID from request'</em> error message</p>

<pre><code>// local const's for testing
const CLNT_GOOGL_SRVC_ACCT_CREDS = '';
const CLNT_GOOGL_API_SRVC_ACCT_CLIENT_ACCESS_CODE = '';
/**
* Returns an authorized API client.
* @return Google_Client the authorized client object
*/
private static function getAuthorizedClient() {
    $client = new Google_Client();
    $isSrvcAcct = false;

    if (self::CLNT_GOOGL_SRVC_ACCT_CREDS) {
        $isSrvcAcct = true;
        $creds = json_decode(self::CLNT_GOOGL_SRVC_ACCT_CREDS, true);
    } elseif (defined('CLNT_GOOGL_SRVC_ACCT_CREDS')) {
        $isSrvcAcct = true;
        $creds = json_decode(CLNT_GOOGL_SRVC_ACCT_CREDS, true);
    }

    if ($isSrvcAcct) {
        if (! isset($creds)) {
            acapApp::catchProcessMessage('CLNT_GOOGL_SRVC_ACCT_CREDS  is not valid JSON?', ACAP_DEBUG);

            return;
        }

        self::setServiceClient($client, (array) $creds);
    } else {
        self::setUserClient($client);
    }

    if ($client-&gt;getAccessToken()) {
        return $client;
    }
}

private static function setServiceClient(Google_Client $client, array $creds) {
    $client-&gt;setAuthConfig($creds);
    $client-&gt;setSubject(CLNT_SMTP_OAUTH_USER_EMAIL);

    if (self::CLNT_GOOGL_API_SRVC_ACCT_CLIENT_ACCESS_CODE) {
        $authCode = self::CLNT_GOOGL_API_SRVC_ACCT_CLIENT_ACCESS_CODE;
    } else if (defined('CLNT_GOOGL_API_SRVC_ACCT_CLIENT_ACCESS_CODE')) {
        $authCode = CLNT_GOOGL_API_SRVC_ACCT_CLIENT_ACCESS_CODE;
    }

    if (isset($authCode)) {
        $authCreds = $client-&gt;fetchAccessTokenWithAuthCode($authCode);
        if (isset($authCreds['error'])) {
            acapApp::catchProcessMessage('Failure Fetching Auth Token: '.$authCreds['error_description'], ACAP_DEBUG);
        }
    }
}
</code></pre>