domainwidedelegation.comStart free

Use cases → Admin and governance

Handle user consent revocation in delegated integrations

Detect and respond when a user revokes consent, ensuring delegated automations do not continue to act on their data without authorisation.

Who it is forTeams running automated processes under domain-wide delegation across many users.
APIsAdmin SDK, Gmail API
Typical scopesadmin.directory.user.readonly, gmail.readonly

The problem

Users can revoke third-party app access from their accounts, but automations running as a service account under domain-wide delegation are not directly notified. Without active checking, revoked users may still be processed, risking unauthorised access and audit gaps.

How it works

  1. Regularly poll the Admin SDK to identify users who have revoked app access.
  2. Cross-check these users against your automation’s subject list.
  3. Immediately exclude any revoked users from all automation runs and jobs.
  4. Log revocations with timestamps for compliance and audit purposes.

What changes

Automations skip users who have withdrawn consent, and audit records reflect all revocations in near real-time.

The trap in this one. Revoked OAuth grants by users do not instantly propagate to the service account: the Admin SDK's app access listing can lag by several hours. During this window, the service account continues to access user data, with no error or warning from the Gmail API. This silent gap means you must design for eventual consistency, not immediate revocation.

Watch it explained

“Internstart – OAuth Consent Screen & Gmail API Verification Demo (Part 2)” — InternStart on YouTube. Third-party video, included because it covers this ground well. We are not affiliated with the channel.

Questions people ask

Can I get a webhook or push notification when a user revokes access?

No. The only way is to poll the Admin SDK for changes. There is no event or webhook for third-party app revocation.

Does revoking access remove all refresh tokens immediately?

For user-authorised apps, yes, but domain-wide delegated service accounts are not affected until the admin explicitly removes the OAuth client from the trusted list, or disables the user.

Want this built?

This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.

Talk to us Or read the setup guide

Related use cases

Automate joiners, movers and leavers

Create accounts, set group membership, provision Drive and hand over mailboxes without a manual checklist.

Continuously verify your delegation still works

A scheduled probe that proves every API still answers under every tenant, before a customer finds out otherwise.

Reduce an over-broad delegation grant safely

Find out which scopes your automation genuinely uses, then cut the grant down to them.