ruby on rails - Using OAuth2 to permit users to authorize as a global user -

apologies oddly worded title, not come better one.

my application should able perform limited set of actions on enterprise google apps system. users submit requests application, application interprets these requests , makes requests google resources necessary.the point users, not have permissions access/modify google apps resources, able use application in limited ways allows.

my problem lies in apparent fact oauth2.0 authorization flow seems designed allow third party client applications authorize user , access/modify user's google resources, rather global administrator's. in other words, normal api key type deal. unfortunately seems google's adminsdk work oauth2 authorization.

is there way use google's adminsdk api oauth2 (permanent access token, maybe? api key?) want? or there different api should trying? now-deprecated provisioning api seemed able this.

i feel there should way application pull out of secrets.json or secrets.yml, include in api authorization request , have google servers recognize , grant access application without user ever needing see what's going on.

for record i'm using ruby on rails, though don't think affects question much.