Assign the permissions your service account needs.
Important
You must be a super admin to complete this task.
Log in to the Google Admin Console: https://admin.google.com/.
Follow steps 1-8 under "Set up domain-wide delegation for a client" in the Google documentation. Make note of the following configuration settings:
For step 5, enter the Unique ID you made note of while creating the service account.
For step 6, paste the following scopes:
smtp https://mail.google.com https://www.googleapis.com/auth/admin.directory.group.readonly https://www.googleapis.com/auth/admin.directory.user.readonly https://www.googleapis.com/auth/admin.directory.group.member.readonly
native https://mail.google.com https://www.googleapis.com/auth/pubsub https://www.googleapis.com/auth/admin.directory.group.readonly https://www.googleapis.com/auth/admin.directory.user.readonly https://www.googleapis.com/auth/admin.directory.group.member.readonly
If the account used to create the service account was not a super admin then see Assign specific admin roles for assigning roles to a user, a list of users or groups as an admin.