You need a service account with domain-wide delegation enabled.

To enable domain-wide delegation for a service account in Google Workspace, you can: Create a service account in the Google Cloud console Copy the service account's Client ID from the Google Cloud console Sign in to the Google Admin console as a super administrator Go to Menu > Security > Access and data control > API controls Select Manage Domain Wide Delegation Click Add new Enter the service account's Client ID Enter a comma-delimited list of OAuth Scopes in the OAuth Scopes field Click Authorize Domain-wide delegation allows a service account to impersonate any user in a Cloud Identity or Workspace account. This gives the service account access to the user's Google Workspace data, bypassing the user's consent.