Google Application Default Credentials - "Insufficient Permission" in development & "Bad Request" in production

Question

I'm using Google Application Default Credentials to fetch the list of Labels using Gmail API.

While running the application locally using gcloud preview app run command, I'm getting HttpError: <HttpError 403 when requesting https://www.googleapis.com/gmail/v1/users/user%40domain.com/labels?alt=json returned "Insufficient Permission">

Then I deployed the application and tried to access. But I got HttpError: <HttpError 400 when requesting https://www.googleapis.com/gmail/v1/users/user%40domain.com/labels?alt=json returned "Bad Request">

I have correct configuration in gcloud config list:

account = my_email@domain.com (Appengine Application Owener & Domain Admin)
disable_usage_reporting = False
project = <appengine_project_id>

gcloud version details:

Google Cloud SDK 0.9.76
app 2015.08.27
app-engine-python 1.9.25
bq 2.0.18
bq-nix 2.0.18
core 2015.08.27
core-nix 2015.06.02
gcloud 2015.08.27
gsutil 4.14
gsutil-nix 4.12
preview 2015.08.27

Also I have added the service account's Client ID & Gmail Scope: https://www.googleapis.com/auth/gmail.readonly in Google Apps admin CPanel and Gmail API enabled in Appengine Console.

Here is the Code:

from googleapiclient.discovery import build
from oauth2client.client import GoogleCredentials

class Connection:
    def __init__(cls):
        cls.credentials = GoogleCredentials.get_application_default()

    def fetch_labels(cls):
        service = build('gmail', 'v1', credentials=cls.credentials)

        logging.info(service)

        results = service.users().labels().list(userId='user@domain.com').execute()
        labels = results.get('labels', [])

        if not labels:
            logging.info('No labels found.')
        else:
            logging.info('Labels:')
            for label in labels:
                logging.info(label['name'])
        pass


class Handler(webapp2.RequestHandler):
    def get(self):
        con = Connection()
        con.fetch_labels()

Answer 1

I am not 100% certain on this, but I do not think that Application Default Credentials supports domain-wide delegation of authority. You will still need to use Service Account Credentials with the sub argument:

credentials = SignedJwtAssertionCredentials(
    service_account_email, service_account_key,
    scope='...', sub=user_email)