I understand what you’re saying but it seems like the issue here is that the only scope that allows create also allows delete: https://developers.google.com/cal

I understand what you’re saying but it seems like the issue here is that the only scope that allows create also allows delete: https://developers.google.com/calendar/api/auth https://developers.google.com/calendar/api/auth. A proxy service that could reduce the scope of the endpoints you explicitly allow would be helpful here as you mentioned.