Domain-wide delegation
A Google Workspace permission that lets an approved app act on users’ settings across a domain.
Domain-wide delegation lets a Google Workspace super admin authorise a service account to call Google APIs on behalf of users in the domain, limited to specific scopes.
For signatures, the scopes are typically read-only directory access and Gmail settings management. The app can then update each user’s signature without that user signing in.
Admins can review or revoke delegated access at any time in the Google Admin console under Security, API controls.